nss: CVE-2017-11697: Floating Point Exception in __hash_open (hash.c:229)

Debian Bug report logs - #873258
nss: CVE-2017-11697: Floating Point Exception in __hash_open (hash.c:229)

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: nss: CVE-2017-11697: Floating Point Exception in __hash_open (hash.c:229)

Date: Fri, 25 Aug 2017 22:52:10 +0200

Source: nss
Version: 2:3.26-1
Severity: important
Tags: upstream security
Forwarded: https://bugzilla.mozilla.org/show_bug.cgi?id=1360900

Hi,

the following vulnerability was published for nss.

CVE-2017-11697[0]:
Floating Point Exception in __hash_open (hash.c:229)

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-11697
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11697

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 873258@bugs.debian.org (full text, mbox, reply):

From: Ola Lundqvist <ola@inguza.com>

To: 873256@bugs.debian.org, 873257@bugs.debian.org, 873258@bugs.debian.org, 873259@bugs.debian.org

Subject: According to Redhat advisory this is not actually a security problem

Date: Fri, 8 Sep 2017 21:27:08 +0200

[Message part 1 (text/plain, inline)]

Hi

I have not been able to confirm this statement as I do not have access to
the bugzilla entries but Redhat advisory claims that in order to exploit
this you actually need to create crafted NDB DBM files which is very likely
to be a problem in practice. Typically you need write access for the user
running the service and then there are easier ways to cause problems than
this. This means that this is really a minor security problem if any. It
would however be good if someone could confirm the statement from Redhat.

I have marked the issue as no-dsa for wheezy but if someone have
information that proove redhat to be wrong then we should change that
statement.

Best regards

// Ola

-- 
 --- Inguza Technology AB --- MSc in Information Technology ----
/  ola@inguza.com                    Folkebogatan 26            \
|  opal@debian.org                   654 68 KARLSTAD            |
|  http://inguza.com/                Mobile: +46 (0)70-332 1551 |
\  gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9  /
 ---------------------------------------------------------------

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.