High 7.5Published Nov 15, 2019

CVE-2016-5285A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote m…

Updated under an hour ago (Nov 2, 2026, 12:10 AM ET)

Does this affect you?

It affects mozilla nss and 26 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for mozilla nss Exploited in the last 30 days

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.

CVSS: 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

mozilla nss mozilla:nss	before 3.26	NVD
debian debian_linux debian:debian_linux	8.0; 9.0; 10.0	NVD
redhat enterprise_linux redhat:enterprise_linux	5.0; 6.0; 7.0	NVD
suse linux_enterprise_server suse:linux_enterprise_server	11	NVD
avaya aura_application_enablement_services avaya:aura_application_enablement_services	from 6.1 through 6.3.3; 7.0	NVD
avaya aura_application_server_5300 avaya:aura_application_server_5300	3.0; 3.0; 3.0; 3.0; 3.0; 3.0; 3.0; 3.0; and 6 more ranges	NVD
avaya aura_communication_manager avaya:aura_communication_manager	from 6.0 through 6.3.117.0; 7.0; 7.0; 7.0	NVD
avaya aura_communication_manager_messagint avaya:aura_communication_manager_messagint	7.0; 7.0	NVD
avaya breeze_platform avaya:breeze_platform	from 3.0 through 3.2	NVD
avaya call_management_system avaya:call_management_system	from 18.0.0.1 through 18.0.0.2; 17.0; 17.0; 17.0; 17.0; 17.0	NVD
1–10 of 27

References

References

http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html	mailing-list, third-party-advisory
http://rhn.redhat.com/errata/RHSA-2016-2779.html
http://www.securityfocus.com/bid/94349
http://www.ubuntu.com/usn/USN-3163-1
https://bto.bluecoat.com/security-advisory/sa137
https://bugzilla.mozilla.org/show_bug.cgi?id=1306103
https://security.gentoo.org/glsa/201701-46

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.