NULL pointer dereference in Mozilla NSS - CVE-2018-18508

Vulnerability identifier: #VU26105

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-18508

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in Mozilla NSS within the  CMS (Cryptographic Message Syntax) API. A remote attacker can perform a denial of service (DoS) attack.

Mozilla NSS
Gentoo Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Opensuse
Fedora
RUGGEDCOM ROS
nss
nss (Red Hat package)
nspr (Red Hat package)

Install updates from vendor's website.

Mozilla NSS - update to 3.41.1
RUGGEDCOM ROS - update to 2.14.0
nss - addressed in versions 3.42.1-1.fc28, 3.42.1-1.fc29
nss (Red Hat package) - update to 3.44.0-7.el8_0
nspr (Red Hat package) - update to 4.21.0-2.el8_0

• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.41.1_release_notes

• Gentoo update for Mozilla Network Security Service
• OpenSUSE Linux update for mozilla-nspr, mozilla-nss
• Multiple vulnerabilities in Siemens RUGGEDCOM ROX IIB
• Red Hat Enterprise Linux 8 update for nss and nspr
• Fedora 28 update for nss
• Fedora 29 update for nss