{"cve":"CVE-2016-5285","nvd":{"published":"2019-11-15T16:15:10.110","modified":"2026-06-17T00:49:07.227","status":"Modified","description":"A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-476"],"references":["http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html","http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html","http://rhn.redhat.com/errata/RHSA-2016-2779.html","http://www.securityfocus.com/bid/94349"],"products":["avaya:aura_application_enablement_services","avaya:aura_application_server_5300","avaya:aura_communication_manager","avaya:aura_communication_manager_messagint","avaya:aura_conferencing","avaya:aura_experience_portal","avaya:aura_messaging","avaya:aura_session_manager","avaya:aura_system_manager","avaya:aura_system_platform_firmware","avaya:aura_utility_services","avaya:breeze_platform","avaya:call_management_system","avaya:cs1000e\\/cs1000m_signaling_server_firmware","avaya:cs1000e_firmware","avaya:cs1000m_firmware","avaya:ip_office","avaya:iq","avaya:meeting_exchange","avaya:message_networking","avaya:one-x_client_enablement_services","avaya:proactive_contact","avaya:session_border_controller_for_enterprise_firmware","debian:debian_linux","mozilla:nss","redhat:enterprise_linux","suse:linux_enterprise_server"],"source":"nvd","synced_at":"2026-10-19T20:59:25.448946135+00:00"},"epss":{"cve":"CVE-2016-5285","score":0.02279,"percentile":0.83127,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}