CVE-2016-5285

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

• mozilla nss (< 3.26) • debian debian linux 8.0 • debian debian linux 9.0 • debian debian linux 10.0 • redhat enterprise linux 5.0 • redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • suse linux enterprise server 11 • avaya aura application enablement services (>= 6.1 <= 6.3.3) • avaya aura application enablement services 7.0 • avaya aura application server 5300 3.0 • avaya aura communication manager (>= 6.0 <= 6.3.117.0) • avaya aura communication manager 7.0 • avaya aura communication manager messagint 7.0 • avaya breeze platform (>= 3.0 <= 3.2) • avaya call management system (>= 18.0.0.1 <= 18.0.0.2) • avaya call management system 17.0 • avaya iq 5.2.x • avaya cs1000e firmware (>= 7.0 <= 7.6) • avaya cs1000m firmware (>= 7.0 <= 7.6) • avaya cs1000e\/cs1000m signaling server firmware (>= 7.0 <= 7.6) • avaya aura conferencing 7.0 • avaya aura conferencing 7.2 • avaya aura conferencing 8.0 • avaya aura experience portal (>= 6.0 <= 7.1) • avaya ip office 8.1 • avaya ip office 9.1 • avaya ip office 10.0 • avaya aura messaging 6.3 • avaya aura messaging 6.3.3 • avaya aura session manager (>= 6.3 <= 6.3.18) • avaya aura session manager 7.0 • avaya aura session manager 7.0.1 • avaya aura system manager (>= 6.3 <= 6.3.18) • avaya aura system manager (>= 7.0 <= 7.0.1.3) • avaya aura utility services (>= 6.3 <= 6.3.14) • avaya aura utility services (>= 7.0 <= 7.0.1.2) • avaya meeting exchange 6.2 • avaya message networking (>= 5.2 <= 6.3) • avaya one-x client enablement services 6.2 • avaya proactive contact (>= 5.0 <= 5.1.2) • avaya session border controller for enterprise firmware (>= 6.2 <= 6.3) • avaya session border controller for enterprise firmware (>= 7.0 <= 7.1) • avaya aura system platform firmware (>= 6.3 <= 6.4.0)