CVE-2017-11697

NameCVE-2017-11697
DescriptionThe __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and crash) via a crafted cert8.db file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs873258

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nss (PTS)bullseye2:3.61-1+deb11u3vulnerable
bullseye (security)2:3.61-1+deb11u4vulnerable
bookworm2:3.87.1-1vulnerable
bookworm (security)2:3.87.1-1+deb12u1vulnerable
trixie2:3.105-2vulnerable
sid2:3.106-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nsssource(unstable)(unfixed)unimportant873258

Notes

Issues triggered by crafted DBM databases, which would
require local user access to a machine running NSS and
crafting the local DBM files.
http://seclists.org/fulldisclosure/2017/Aug/17
https://bugzilla.mozilla.org/show_bug.cgi?id=1360900

Search for package or bug name: Reporting problems