CVE-2017-11697

NameCVE-2017-11697
DescriptionThe __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and crash) via a crafted cert8.db file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs873258

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nss (PTS)jessie, jessie (lts)2:3.26-1+debu8u18vulnerable
stretch (security)2:3.26.2-1.1+deb9u5vulnerable
stretch (lts), stretch2:3.26.2-1.1+deb9u7vulnerable
buster (security), buster, buster (lts)2:3.42.1-1+deb10u8vulnerable
bullseye (security), bullseye2:3.61-1+deb11u3vulnerable
bookworm2:3.87.1-1vulnerable
trixie2:3.103-1vulnerable
sid2:3.105-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nsssource(unstable)(unfixed)unimportant873258

Notes

Issues triggered by crafted DBM databases, which would
require local user access to a machine running NSS and
crafting the local DBM files.
http://seclists.org/fulldisclosure/2017/Aug/17
https://bugzilla.mozilla.org/show_bug.cgi?id=1360900

Search for package or bug name: Reporting problems