An update for nss is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es) :

* A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

Bug Fix(es) :

* The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017. (BZ# 1451421)

According to the version of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A null pointer dereference flaw was found in the way     NSS handled empty SSLv2 messages. An attacker could use     this flaw to crash a server application compiled     against the NSS library. (CVE-2017-7502)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1683:01 advisory.

    Network Security Services (NSS) is a set of libraries designed to     support cross-platform development of security-enabled client and     server applications. Applications built with NSS can support SSL v2     and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509     v3 certificates, and other security standards.
    Security issues fixed with this release:
    CVE-2017-7502
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Fixed bugs:
    * The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet     the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The     updated CA list improves compatibility with the certificates that are used in the Internet Public Key     Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated     CA list on June 12, 2017.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1365 advisory.

    [3.28.4-1.2.0.1]
    - Added nss-vendor.patch to change vendor

    [3.28.4-1.2]
    - Include CKBI 2.14 and updated CA constraints from NSS 3.28.5

    [3.28.4-1.1]
    - Fix zero-length record treatment in SSL3_GatherData

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1365 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could     use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

    Bug Fix(es):

    * The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet     the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The     updated CA list improves compatibility with the certificates that are used in the Internet Public Key     Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated     CA list on June 12, 2017. (BZ#1451421)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for nss is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es) :

* A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

Bug Fix(es) :

* The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017. (BZ# 1451421)

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has nss packages installed that are affected by multiple vulnerabilities:

  - An out-of-bounds write flaw was found in the way NSS     performed certain Base64-decoding operations. An     attacker could use this flaw to create a specially     crafted certificate which, when parsed by NSS, could     cause it to crash or execute arbitrary code, using the     permissions of the user running an application compiled     against the NSS library. (CVE-2017-5461)

  - A null pointer dereference flaw was found in the way NSS     handled empty SSLv2 messages. An attacker could use this     flaw to crash a server application compiled against the     NSS library. (CVE-2017-7502)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - A NULL pointer dereference flaw was found in the way NSS     handled empty SSLv2 messages. An attacker could use this     flaw to crash a server application compiled against the     NSS library. (CVE-2017-7502)

Bug Fix(es) :

  - The Network Security Services (NSS) code and Certificate     Authority (CA) list have been updated to meet the     recommendations as published with the latest Mozilla     Firefox Extended Support Release (ESR). The updated CA     list improves compatibility with the certificates that     are used in the Internet Public Key Infrastructure     (PKI). To avoid certificate validation refusals,     consider installing the updated CA list on June 12,     2017.

An update for nss is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es) :

* A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

Bug Fix(es) :

* The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The updated CA list improves compatibility with the certificates that are used in the Internet Public Key Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated CA list on June 12, 2017. (BZ# 1448488)

Several vulnerabilities were discovered in NSS, a set of cryptographic libraries, which may result in denial of service or information disclosure.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2     messages resulting into denial of service by remote attacker. (CVE-2017-7502)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-1684:01 advisory.

    Network Security Services (NSS) is a set of libraries designed to     support cross-platform development of security-enabled client and     server applications. Applications built with NSS can support SSL v2     and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509     v3 certificates, and other security standards.
    Security issues fixed with this release:
    CVE-2017-7502
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Fixed bugs:
    * The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet     the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The     updated CA list improves compatibility with the certificates that are used in the Internet Public Key     Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated     CA list on June 12, 2017.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-1364 advisory.

    [3.28.4-3.0.1]
    - Added nss-vendor.patch to change vendor
    - Temporarily disable some tests until expired PayPalEE.cert is renewed

    [3.28.4-3]
    - Fix zero-length record treatment for stream ciphers and SSLv2

    [3.28.4-2]
    - Include CKBI 2.14 and updated CA constraints from NSS 3.28.5

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1364 advisory.

    Network Security Services (NSS) is a set of libraries designed to support the cross-platform development     of security-enabled client and server applications.

    Security Fix(es):

    * A null pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could     use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

    Bug Fix(es):

    * The Network Security Services (NSS) code and Certificate Authority (CA) list have been updated to meet     the recommendations as published with the latest Mozilla Firefox Extended Support Release (ESR). The     updated CA list improves compatibility with the certificates that are used in the Internet Public Key     Infrastructure (PKI). To avoid certificate validation refusals, Red Hat recommends installing the updated     CA list on June 12, 2017. (BZ#1448488)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

NULL pointer dereference when handling empty SSLv2 messages :

A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. (CVE-2017-7502)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
100556	CentOS 7 : nss (CESA-2017:1365)	Nessus	CentOS Local Security Checks	2017/6/1	2021/1/4	high
100701	EulerOS 2.0 SP1 : nss (EulerOS-SA-2017-1108)	Nessus	Huawei Local Security Checks	2017/6/9	2025/12/16	high
289374	MiracleLinux 4 : nss-3.28.4-3.AXS4 (AXSA:2017-1683:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
100526	Oracle Linux 7 : nss (ELSA-2017-1365)	Nessus	Oracle Linux Local Security Checks	2017/5/31	2024/11/1	high
100532	RHEL 7 : nss (RHSA-2017:1365)	Nessus	Red Hat Local Security Checks	2017/5/31	2024/11/4	high
100702	EulerOS 2.0 SP2 : nss (EulerOS-SA-2017-1109)	Nessus	Huawei Local Security Checks	2017/6/9	2025/12/16	high
101476	Virtuozzo 7 : nss / nss-devel / nss-pkcs11-devel / nss-sysinit / etc (VZLSA-2017-1365)	Nessus	Virtuozzo Local Security Checks	2017/7/13	2025/12/11	high
127337	NewStart CGSL MAIN 4.05 : nss Multiple Vulnerabilities (NS-SA-2019-0105)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	critical
100535	Scientific Linux Security Update : nss on SL6.x i386/x86_64 (20170530)	Nessus	Scientific Linux Local Security Checks	2017/5/31	2025/12/17	high
100555	CentOS 6 : nss (CESA-2017:1364)	Nessus	CentOS Local Security Checks	2017/6/1	2021/1/4	high
100580	Debian DSA-3872-1 : nss - security update	Nessus	Debian Local Security Checks	2017/6/2	2025/12/17	critical
221690	Linux Distros Unpatched Vulnerability : CVE-2017-7502	Nessus	Misc.	2025/3/4	2026/1/28	high
289018	MiracleLinux 7 : nss-3.28.4-1.2.el7 (AXSA:2017-1684:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
100525	Oracle Linux 6 : nss (ELSA-2017-1364)	Nessus	Oracle Linux Local Security Checks	2017/5/31	2024/10/22	high
100531	RHEL 6 : nss (RHSA-2017:1364)	Nessus	Red Hat Local Security Checks	2017/5/31	2024/11/4	high
100536	Scientific Linux Security Update : nss on SL7.x x86_64 (20170530)	Nessus	Scientific Linux Local Security Checks	2017/5/31	2025/12/17	high
101001	Amazon Linux AMI : nss (ALAS-2017-848)	Nessus	Amazon Linux Local Security Checks	2017/6/23	2025/12/15	high

检测

插件搜索

high

high

high

high

high

high

high

critical

high

high

critical

high

high

high

high

high

high