ID CVE-2013-5607
Summary Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741.
References
Vulnerable Configurations
  • Mozilla Netscape Portable Runtime (NSPR) 4.1.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.1.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.1.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.1.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.2.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.2.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.4.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.4.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.5.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.5.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.4
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.4
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.5
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.5
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.7
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.7
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.8
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.8
  • Mozilla Netscape Portable Runtime (NSPR) 4.7
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.4
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.4
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.5
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.5
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.8
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.4
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.4
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.5
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.5
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.7
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.7
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.8
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.8
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.9
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.9
  • Mozilla Netscape Portable Runtime (NSPR) 4.9
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.4
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.4
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.5
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.5
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.10
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10
  • Mozilla Netscape Portable Runtime (NSPR) 4.10.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.1
  • Mozilla SeaMonkey 2.0
    cpe:2.3:a:mozilla:seamonkey:2.0
  • Mozilla SeaMonkey 2.0 Alpha 1
    cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1
  • Mozilla SeaMonkey 2.0 Alpha 2
    cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2
  • Mozilla SeaMonkey 2.0 Alpha 3
    cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3
  • Mozilla SeaMonkey 2.0 Beta 1
    cpe:2.3:a:mozilla:seamonkey:2.0:beta_1
  • Mozilla SeaMonkey 2.0 Beta 2
    cpe:2.3:a:mozilla:seamonkey:2.0:beta_2
  • Mozilla SeaMonkey 2.0 RC1
    cpe:2.3:a:mozilla:seamonkey:2.0:rc1
  • Mozilla SeaMonkey 2.0 RC2
    cpe:2.3:a:mozilla:seamonkey:2.0:rc2
  • Mozilla SeaMonkey 2.0.1
    cpe:2.3:a:mozilla:seamonkey:2.0.1
  • Mozilla SeaMonkey 2.0.2
    cpe:2.3:a:mozilla:seamonkey:2.0.2
  • Mozilla SeaMonkey 2.0.3
    cpe:2.3:a:mozilla:seamonkey:2.0.3
  • Mozilla SeaMonkey 2.0.4
    cpe:2.3:a:mozilla:seamonkey:2.0.4
  • Mozilla SeaMonkey 2.0.5
    cpe:2.3:a:mozilla:seamonkey:2.0.5
  • Mozilla SeaMonkey 2.0.6
    cpe:2.3:a:mozilla:seamonkey:2.0.6
  • Mozilla SeaMonkey 2.0.7
    cpe:2.3:a:mozilla:seamonkey:2.0.7
  • Mozilla SeaMonkey 2.0.8
    cpe:2.3:a:mozilla:seamonkey:2.0.8
  • Mozilla SeaMonkey 2.0.9
    cpe:2.3:a:mozilla:seamonkey:2.0.9
  • Mozilla SeaMonkey 2.0.10
    cpe:2.3:a:mozilla:seamonkey:2.0.10
  • Mozilla SeaMonkey 2.0.11
    cpe:2.3:a:mozilla:seamonkey:2.0.11
  • Mozilla SeaMonkey 2.0.12
    cpe:2.3:a:mozilla:seamonkey:2.0.12
  • Mozilla SeaMonkey 2.0.13
    cpe:2.3:a:mozilla:seamonkey:2.0.13
  • Mozilla SeaMonkey 2.0.14
    cpe:2.3:a:mozilla:seamonkey:2.0.14
  • Mozilla SeaMonkey 2.1
    cpe:2.3:a:mozilla:seamonkey:2.1
  • Mozilla SeaMonkey 2.1 alpha1
    cpe:2.3:a:mozilla:seamonkey:2.1:alpha1
  • Mozilla SeaMonkey 2.1 alpha2
    cpe:2.3:a:mozilla:seamonkey:2.1:alpha2
  • Mozilla SeaMonkey 2.1 alpha3
    cpe:2.3:a:mozilla:seamonkey:2.1:alpha3
  • Mozilla SeaMonkey 2.1 Beta 1
    cpe:2.3:a:mozilla:seamonkey:2.1:beta1
  • Mozilla SeaMonkey 2.1 Beta 2
    cpe:2.3:a:mozilla:seamonkey:2.1:beta2
  • Mozilla SeaMonkey 2.1 Beta 3
    cpe:2.3:a:mozilla:seamonkey:2.1:beta3
  • Mozilla SeaMonkey 2.1 Release Candidate 1
    cpe:2.3:a:mozilla:seamonkey:2.1:rc1
  • Mozilla SeaMonkey 2.1 Release Candidate 2
    cpe:2.3:a:mozilla:seamonkey:2.1:rc2
  • Mozilla SeaMonkey 2.10
    cpe:2.3:a:mozilla:seamonkey:2.10
  • Mozilla SeaMonkey 2.10 beta1
    cpe:2.3:a:mozilla:seamonkey:2.10:beta1
  • Mozilla SeaMonkey 2.10 beta2
    cpe:2.3:a:mozilla:seamonkey:2.10:beta2
  • Mozilla SeaMonkey 2.10 beta3
    cpe:2.3:a:mozilla:seamonkey:2.10:beta3
  • Mozilla SeaMonkey 2.10.1
    cpe:2.3:a:mozilla:seamonkey:2.10.1
  • Mozilla SeaMonkey 2.11
    cpe:2.3:a:mozilla:seamonkey:2.11
  • Mozilla SeaMonkey 2.11 beta1
    cpe:2.3:a:mozilla:seamonkey:2.11:beta1
  • Mozilla SeaMonkey 2.11 beta2
    cpe:2.3:a:mozilla:seamonkey:2.11:beta2
  • Mozilla SeaMonkey 2.11 beta3
    cpe:2.3:a:mozilla:seamonkey:2.11:beta3
  • Mozilla SeaMonkey 2.11 beta4
    cpe:2.3:a:mozilla:seamonkey:2.11:beta4
  • Mozilla SeaMonkey 2.11 beta5
    cpe:2.3:a:mozilla:seamonkey:2.11:beta5
  • Mozilla SeaMonkey 2.11 beta6
    cpe:2.3:a:mozilla:seamonkey:2.11:beta6
  • Mozilla SeaMonkey 2.12
    cpe:2.3:a:mozilla:seamonkey:2.12
  • Mozilla SeaMonkey 2.12 beta1
    cpe:2.3:a:mozilla:seamonkey:2.12:beta1
  • Mozilla SeaMonkey 2.12 beta2
    cpe:2.3:a:mozilla:seamonkey:2.12:beta2
  • Mozilla SeaMonkey 2.12 beta3
    cpe:2.3:a:mozilla:seamonkey:2.12:beta3
  • Mozilla SeaMonkey 2.12 beta4
    cpe:2.3:a:mozilla:seamonkey:2.12:beta4
  • Mozilla SeaMonkey 2.12 beta5
    cpe:2.3:a:mozilla:seamonkey:2.12:beta5
  • Mozilla SeaMonkey 2.12 beta6
    cpe:2.3:a:mozilla:seamonkey:2.12:beta6
  • Mozilla SeaMonkey 2.12.1
    cpe:2.3:a:mozilla:seamonkey:2.12.1
  • Mozilla SeaMonkey 2.13
    cpe:2.3:a:mozilla:seamonkey:2.13
  • Mozilla SeaMonkey 2.13 beta1
    cpe:2.3:a:mozilla:seamonkey:2.13:beta1
  • Mozilla SeaMonkey 2.13 beta2
    cpe:2.3:a:mozilla:seamonkey:2.13:beta2
  • Mozilla SeaMonkey 2.13 beta3
    cpe:2.3:a:mozilla:seamonkey:2.13:beta3
  • Mozilla SeaMonkey 2.13 beta4
    cpe:2.3:a:mozilla:seamonkey:2.13:beta4
  • Mozilla SeaMonkey 2.13 beta5
    cpe:2.3:a:mozilla:seamonkey:2.13:beta5
  • Mozilla SeaMonkey 2.13 beta6
    cpe:2.3:a:mozilla:seamonkey:2.13:beta6
  • Mozilla SeaMonkey 2.13.1
    cpe:2.3:a:mozilla:seamonkey:2.13.1
  • Mozilla Seamonkey 2.13.2
    cpe:2.3:a:mozilla:seamonkey:2.13.2
  • Mozilla Seamonkey 2.14
    cpe:2.3:a:mozilla:seamonkey:2.14
  • Mozilla Seamonkey 2.14 beta1
    cpe:2.3:a:mozilla:seamonkey:2.14:beta1
  • Mozilla Seamonkey 2.14 beta2
    cpe:2.3:a:mozilla:seamonkey:2.14:beta2
  • Mozilla Seamonkey 2.14 beta3
    cpe:2.3:a:mozilla:seamonkey:2.14:beta3
  • Mozilla Seamonkey 2.14 beta4
    cpe:2.3:a:mozilla:seamonkey:2.14:beta4
  • Mozilla Seamonkey 2.14 beta5
    cpe:2.3:a:mozilla:seamonkey:2.14:beta5
  • Mozilla Seamonkey 2.15
    cpe:2.3:a:mozilla:seamonkey:2.15
  • Mozilla Seamonkey 2.15 beta1
    cpe:2.3:a:mozilla:seamonkey:2.15:beta1
  • Mozilla Seamonkey 2.15 beta2
    cpe:2.3:a:mozilla:seamonkey:2.15:beta2
  • Mozilla Seamonkey 2.15 beta3
    cpe:2.3:a:mozilla:seamonkey:2.15:beta3
  • Mozilla Seamonkey 2.15 beta4
    cpe:2.3:a:mozilla:seamonkey:2.15:beta4
  • Mozilla Seamonkey 2.15 beta5
    cpe:2.3:a:mozilla:seamonkey:2.15:beta5
  • Mozilla Seamonkey 2.15 beta6
    cpe:2.3:a:mozilla:seamonkey:2.15:beta6
  • Mozilla Seamonkey 2.15.1
    cpe:2.3:a:mozilla:seamonkey:2.15.1
  • Mozilla Seamonkey 2.15.2
    cpe:2.3:a:mozilla:seamonkey:2.15.2
  • Mozilla Seamonkey 2.16
    cpe:2.3:a:mozilla:seamonkey:2.16
  • Mozilla Seamonkey 2.16 beta1
    cpe:2.3:a:mozilla:seamonkey:2.16:beta1
  • Mozilla Seamonkey 2.16 beta2
    cpe:2.3:a:mozilla:seamonkey:2.16:beta2
  • Mozilla Seamonkey 2.16 beta3
    cpe:2.3:a:mozilla:seamonkey:2.16:beta3
  • Mozilla Seamonkey 2.16 beta4
    cpe:2.3:a:mozilla:seamonkey:2.16:beta4
  • Mozilla Seamonkey 2.16 beta5
    cpe:2.3:a:mozilla:seamonkey:2.16:beta5
  • Mozilla Seamonkey 2.16.1
    cpe:2.3:a:mozilla:seamonkey:2.16.1
  • Mozilla Seamonkey 2.16.2
    cpe:2.3:a:mozilla:seamonkey:2.16.2
  • Mozilla Seamonkey 2.17
    cpe:2.3:a:mozilla:seamonkey:2.17
  • Mozilla Seamonkey 2.17 beta1
    cpe:2.3:a:mozilla:seamonkey:2.17:beta1
  • Mozilla Seamonkey 2.17 beta2
    cpe:2.3:a:mozilla:seamonkey:2.17:beta2
  • Mozilla Seamonkey 2.17 beta3
    cpe:2.3:a:mozilla:seamonkey:2.17:beta3
  • Mozilla Seamonkey 2.17 beta4
    cpe:2.3:a:mozilla:seamonkey:2.17:beta4
  • Mozilla SeaMonkey 2.17.1
    cpe:2.3:a:mozilla:seamonkey:2.17.1
  • Mozilla SeaMonkey 2.18 beta1
    cpe:2.3:a:mozilla:seamonkey:2.18:beta1
  • Mozilla SeaMonkey 2.18 beta2
    cpe:2.3:a:mozilla:seamonkey:2.18:beta2
  • Mozilla SeaMonkey 2.18 beta3
    cpe:2.3:a:mozilla:seamonkey:2.18:beta3
  • Mozilla SeaMonkey 2.18 beta4
    cpe:2.3:a:mozilla:seamonkey:2.18:beta4
  • Mozilla SeaMonkey 2.19
    cpe:2.3:a:mozilla:seamonkey:2.19
  • Mozilla SeaMonkey 2.19 beta1
    cpe:2.3:a:mozilla:seamonkey:2.19:beta1
  • Mozilla SeaMonkey 2.19 beta2
    cpe:2.3:a:mozilla:seamonkey:2.19:beta2
  • Mozilla SeaMonkey 2.20
    cpe:2.3:a:mozilla:seamonkey:2.20
  • Mozilla SeaMonkey 2.20 beta1
    cpe:2.3:a:mozilla:seamonkey:2.20:beta1
  • Mozilla SeaMonkey 2.20 beta2
    cpe:2.3:a:mozilla:seamonkey:2.20:beta2
  • Mozilla SeaMonkey 2.20 beta3
    cpe:2.3:a:mozilla:seamonkey:2.20:beta3
  • cpe:2.3:a:mozilla:seamonkey:2.21
    cpe:2.3:a:mozilla:seamonkey:2.21
  • Mozilla SeaMonkey 2.21 beta1
    cpe:2.3:a:mozilla:seamonkey:2.21:beta1
  • Mozilla SeaMonkey 2.21 beta2
    cpe:2.3:a:mozilla:seamonkey:2.21:beta2
  • cpe:2.3:a:mozilla:seamonkey:2.22
    cpe:2.3:a:mozilla:seamonkey:2.22
  • Mozilla SeaMonkey 2.22 beta1
    cpe:2.3:a:mozilla:seamonkey:2.22:beta1
  • Mozilla SeaMonkey 2.22 beta2
    cpe:2.3:a:mozilla:seamonkey:2.22:beta2
  • Mozilla Firefox Extended Support Release (ESR) 17.0
    cpe:2.3:a:mozilla:firefox_esr:17.0
  • Mozilla Firefox Extended Support Release (ESR) 17.0.1
    cpe:2.3:a:mozilla:firefox_esr:17.0.1
  • Mozilla Firefox Extended Support Release (ESR) 17.0.2
    cpe:2.3:a:mozilla:firefox_esr:17.0.2
  • Mozilla Firefox Extended Support Release (ESR) 17.0.3
    cpe:2.3:a:mozilla:firefox_esr:17.0.3
  • Mozilla Firefox Extended Support Release (ESR) 17.0.4
    cpe:2.3:a:mozilla:firefox_esr:17.0.4
  • Mozilla Firefox Extended Support Release (ESR) 17.0.5
    cpe:2.3:a:mozilla:firefox_esr:17.0.5
  • Mozilla Firefox Extended Support Release (ESR) 17.0.6
    cpe:2.3:a:mozilla:firefox_esr:17.0.6
  • Mozilla Firefox Extended Support Release (ESR) 17.0.7
    cpe:2.3:a:mozilla:firefox_esr:17.0.7
  • Mozilla Firefox Extended Support Release (ESR) 17.0.8
    cpe:2.3:a:mozilla:firefox_esr:17.0.8
  • Mozilla Firefox Extended Support Release (ESR) 17.0.9
    cpe:2.3:a:mozilla:firefox_esr:17.0.9
  • Mozilla Firefox Extended Support Release (ESR) 17.0.10
    cpe:2.3:a:mozilla:firefox_esr:17.0.10
  • Mozilla Firefox Extended Support Release (ESR) 24.0
    cpe:2.3:a:mozilla:firefox_esr:24.0
  • Mozilla Firefox Extended Support Release (ESR) 24.0.1
    cpe:2.3:a:mozilla:firefox_esr:24.0.1
  • Mozilla Firefox Extended Support Release (ESR) 24.0.2
    cpe:2.3:a:mozilla:firefox_esr:24.0.2
  • Mozilla Firefox 19.0
    cpe:2.3:a:mozilla:firefox:19.0
  • Mozilla Firefox 19.0.1
    cpe:2.3:a:mozilla:firefox:19.0.1
  • Mozilla Firefox 19.0.2
    cpe:2.3:a:mozilla:firefox:19.0.2
  • Mozilla Firefox 20.0
    cpe:2.3:a:mozilla:firefox:20.0
  • Mozilla Firefox 20.0.1
    cpe:2.3:a:mozilla:firefox:20.0.1
  • Mozilla Firefox 21.0
    cpe:2.3:a:mozilla:firefox:21.0
  • Mozilla Firefox 22.0
    cpe:2.3:a:mozilla:firefox:22.0
  • Mozilla Firefox 23.0
    cpe:2.3:a:mozilla:firefox:23.0
  • Mozilla Firefox 23.0.1
    cpe:2.3:a:mozilla:firefox:23.0.1
  • Mozilla Firefox 24.0
    cpe:2.3:a:mozilla:firefox:24.0
  • Mozilla Firefox 25.0
    cpe:2.3:a:mozilla:firefox:25.0
CVSS
Base: 7.5 (as of 20-11-2013 - 13:52)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2087-1.NASL
    description It was discovered that NSPR incorrectly handled certain malformed X.509 certificates. A remote attacker could use a crafted X.509 certificate to cause NSPR to crash, leading to a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 72115
    published 2014-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=72115
    title Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : nspr vulnerability (USN-2087-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-23159.NASL
    description Update to nspr-4.10.2 to address CVE-2013-5607 nspr: Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 71332
    published 2013-12-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71332
    title Fedora 19 : nspr-4.10.2-1.fc19 (2013-23159)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-23139.NASL
    description Update to nspr-4.10.2 to address CVE-2013-5607 nspr: Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 71385
    published 2013-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71385
    title Fedora 18 : nspr-4.10.2-1.fc18 (2013-23139)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2820.NASL
    description It was discovered that NSPR, Netscape Portable Runtime library, could crash an application using the library when parsing a certificate that causes an integer overflow. This flaw only affects 64-bit systems.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 71502
    published 2013-12-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71502
    title Debian DSA-2820-1 : nspr - integer overflow
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2013-265.NASL
    description A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741 , CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 71577
    published 2013-12-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71577
    title Amazon Linux AMI : nss (ALAS-2013-265)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20131205_NSS_AND_NSPR_ON_SL5_X.NASL
    description A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 released via SLSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606) In addition, the nss package has been upgraded to upstream version 3.15.3, and the nspr package has been upgraded to upstream version 4.10.2. These updates provide a number of bug fixes and enhancements over the previous versions. This update also fixes the following bug : - The SLBA-2013:1318 update introduced a regression that prevented the use of certificates that have an MD5 signature. This update fixes this regression and certificates that have an MD5 signature are once again supported. To prevent the use of certificates that have an MD5 signature, set the 'NSS_HASH_ALG_SUPPORT' environment variable to '-MD5'. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 71306
    published 2013-12-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71306
    title Scientific Linux Security Update : nss and nspr on SL5.x i386/x86_64
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2031-1.NASL
    description Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, potentially execute arbitrary code, or lead to information disclosure. (CVE-2013-1741, CVE-2013-2566, CVE-2013-5605, CVE-2013-5607). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 71021
    published 2013-11-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71021
    title Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : firefox vulnerabilities (USN-2031-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-1791.NASL
    description Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606) Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607. In addition, the nss package has been upgraded to upstream version 3.15.3, and the nspr package has been upgraded to upstream version 4.10.2. These updates provide a number of bug fixes and enhancements over the previous versions. (BZ#1033478, BZ#1020520) This update also fixes the following bug : * The RHBA-2013:1318 update introduced a regression that prevented the use of certificates that have an MD5 signature. This update fixes this regression and certificates that have an MD5 signature are once again supported. To prevent the use of certificates that have an MD5 signature, set the 'NSS_HASH_ALG_SUPPORT' environment variable to '-MD5'. (BZ#1033499) Users of NSS and NSPR are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 71237
    published 2013-12-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71237
    title CentOS 5 : nspr / nss (CESA-2013:1791)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201504-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact. Workaround : There are no known workarounds at this time.
    last seen 2019-02-21
    modified 2016-11-11
    plugin id 82632
    published 2015-04-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82632
    title GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1791.NASL
    description Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606) Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607. In addition, the nss package has been upgraded to upstream version 3.15.3, and the nspr package has been upgraded to upstream version 4.10.2. These updates provide a number of bug fixes and enhancements over the previous versions. (BZ#1033478, BZ#1020520) This update also fixes the following bug : * The RHBA-2013:1318 update introduced a regression that prevented the use of certificates that have an MD5 signature. This update fixes this regression and certificates that have an MD5 signature are once again supported. To prevent the use of certificates that have an MD5 signature, set the 'NSS_HASH_ALG_SUPPORT' environment variable to '-MD5'. (BZ#1033499) Users of NSS and NSPR are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 71243
    published 2013-12-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71243
    title RHEL 5 : nss and nspr (RHSA-2013:1791)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2032-1.NASL
    description Multiple security issues were discovered in Thunderbird. If a user were tricked into connecting to a malicious server, an attacker could possibly exploit these to cause a denial of service via application crash, potentially execute arbitrary code, or lead to information disclosure. (CVE-2013-1741, CVE-2013-2566, CVE-2013-5605, CVE-2013-5607). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 71036
    published 2013-11-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71036
    title Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : thunderbird vulnerabilities (USN-2032-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201406-19.NASL
    description The remote host is affected by the vulnerability described in GLSA-201406-19 (Mozilla Network Security Service: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in the Mozilla Network Security Service. Please review the CVE identifiers referenced below for more details about the vulnerabilities. Impact : A remote attacker can cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-13
    plugin id 76178
    published 2014-06-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76178
    title GLSA-201406-19 : Mozilla Network Security Service: Multiple vulnerabilities
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-1829.NASL
    description Updated nss, nspr, and nss-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606) Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607. All NSS, NSPR, and nss-util users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, applications using NSS, NSPR, or nss-util must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 71380
    published 2013-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71380
    title CentOS 6 : nspr / nss / nss-util (CESA-2013:1829)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_NSS-201311-131121.NASL
    description Mozilla NSPR and NSS were updated to fix various security bugs that could be used to crash the browser or potentially execute code. Mozilla NSPR 4.10.2 has the following bug fixes : - Bug 770534: Possible pointer overflow in PL_ArenaAllocate(). Fixed by Pascal Cuoq and Kamil Dudka. - Bug 888546: ptio.c:PR_ImportUDPSocket doesn't work. Fixed by Miloslav Trmac. - Bug 915522: VS2013 support for NSPR. Fixed by Makoto Kato. - Bug 927687: Avoid unsigned integer wrapping in PL_ArenaAllocate. (CVE-2013-5607) Mozilla NSS 3.15.3 is a patch release for NSS 3.15 and includes the following bug fixes : - Bug 925100: Ensure a size is <= half of the maximum PRUint32 value. (CVE-2013-1741) - Bug 934016: Handle invalid handshake packets. (CVE-2013-5605) - Bug 910438: Return the correct result in CERT_VerifyCert on failure, if a verifyLog isn't used. (CVE-2013-5606)
    last seen 2019-02-21
    modified 2013-12-03
    plugin id 71172
    published 2013-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71172
    title SuSE 11.2 / 11.3 Security Update : mozilla-nspr, mozilla-nss (SAT Patch Numbers 8572 / 8573)
  • NASL family Windows
    NASL id SEAMONKEY_2221.NASL
    description The installed version of SeaMonkey is a version prior to 2.22.1 and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to handling input greater than half the maximum size of the 'PRUint32' value. (CVE-2013-1741) - An error exists in the 'Null_Cipher' function in the file 'ssl/ssl3con.c' related to handling invalid handshake packets that could allow arbitrary code execution. (CVE-2013-5605) - An error exists in the 'CERT_VerifyCert' function in the file 'lib/certhigh/certvfy.c' that could allow invalid certificates to be treated as valid. (CVE-2013-5606) - An integer truncation error exists in the function 'PL_ArenaAllocate' in the Netscape Portable Runtime (NSPR) library. (CVE-2013-5607)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 70950
    published 2013-11-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70950
    title SeaMonkey < 2.22.1 NSS and NSPR Multiple Vulnerabilities
  • NASL family Windows
    NASL id MOZILLA_THUNDERBIRD_24_1_1.NASL
    description The installed version of Thunderbird is earlier than 24.1.1 and is, therefore, potentially affected the following vulnerabilities: - An error exists related to handling input greater than half the maximum size of the 'PRUint32' value. (CVE-2013-1741) - An error exists in the 'Null_Cipher' function in the file 'ssl/ssl3con.c' related to handling invalid handshake packets that could allow arbitrary code execution. (CVE-2013-5605) - An error exists in the 'CERT_VerifyCert' function in the file 'lib/certhigh/certvfy.c' that could allow invalid certificates to be treated as valid. (CVE-2013-5606) - An integer truncation error exists in the function 'PL_ArenaAllocate' in the Netscape Portable Runtime (NSPR) library. (CVE-2013-5607)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 71045
    published 2013-11-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71045
    title Mozilla Thunderbird < 24.1.1 NSS and NSPR Multiple Vulnerabilities
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_24_1_1_ESR.NASL
    description The installed version of Firefox ESR 24.x is a version prior to 24.1.1, and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to handling input greater than half the maximum size of the 'PRUint32' value. (CVE-2013-1741) - An error exists in the 'Null_Cipher' function in the file 'ssl/ssl3con.c' related to handling invalid handshake packets that could allow arbitrary code execution. (CVE-2013-5605) - An error exists in the 'CERT_VerifyCert' function in the file 'lib/certhigh/certvfy.c' that could allow invalid certificates to be treated as valid. (CVE-2013-5606) - An integer truncation error exists in the function 'PL_ArenaAllocate' in the Netscape Portable Runtime (NSPR) library. (CVE-2013-5607)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 70948
    published 2013-11-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70948
    title Firefox ESR 24.x < 24.1.1 NSS and NSPR Multiple Vulnerabilities
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20131212_NSS__NSPR__AND_NSS_UTIL_ON_SL6_X.NASL
    description A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 released via SLSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606) After installing this update, applications using NSS, NSPR, or nss-util must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 71424
    published 2013-12-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71424
    title Scientific Linux Security Update : nss, nspr, and nss-util on SL6.x i386/x86_64
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-1791.NASL
    description From Red Hat Security Advisory 2013:1791 : Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606) Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607. In addition, the nss package has been upgraded to upstream version 3.15.3, and the nspr package has been upgraded to upstream version 4.10.2. These updates provide a number of bug fixes and enhancements over the previous versions. (BZ#1033478, BZ#1020520) This update also fixes the following bug : * The RHBA-2013:1318 update introduced a regression that prevented the use of certificates that have an MD5 signature. This update fixes this regression and certificates that have an MD5 signature are once again supported. To prevent the use of certificates that have an MD5 signature, set the 'NSS_HASH_ALG_SUPPORT' environment variable to '-MD5'. (BZ#1033499) Users of NSS and NSPR are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 71241
    published 2013-12-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71241
    title Oracle Linux 5 : nspr / nss (ELSA-2013-1791)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-1829.NASL
    description From Red Hat Security Advisory 2013:1829 : Updated nss, nspr, and nss-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606) Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607. All NSS, NSPR, and nss-util users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, applications using NSS, NSPR, or nss-util must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 71388
    published 2013-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71388
    title Oracle Linux 6 : nspr / nss / nss-util (ELSA-2013-1829)
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_2501.NASL
    description The installed version of Firefox is a version prior to 25.0.1 and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to handling input greater than half the maximum size of the 'PRUint32' value. (CVE-2013-1741) - An error exists in the 'Null_Cipher' function in the file 'ssl/ssl3con.c' related to handling invalid handshake packets that could allow arbitrary code execution. (CVE-2013-5605) - An error exists in the 'CERT_VerifyCert' function in the file 'lib/certhigh/certvfy.c' that could allow invalid certificates to be treated as valid. (CVE-2013-5606) - An integer truncation error exists in the function 'PL_ArenaAllocate' in the Netscape Portable Runtime (NSPR) library. (CVE-2013-5607)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 70949
    published 2013-11-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70949
    title Firefox < 25.0.1 NSS and NSPR Multiple Vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_24_1_1_ESR.NASL
    description The installed version of Firefox ESR 24.x is a version prior to 24.1.1 and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to handling input greater than half the maximum size of the 'PRUint32' value. (CVE-2013-1741) - An error exists in the 'Null_Cipher' function in the file 'ssl/ssl3con.c' related to handling invalid handshake packets that could allow arbitrary code execution. (CVE-2013-5605) - An error exists in the 'CERT_VerifyCert' function in the file 'lib/certhigh/certvfy.c' that could allow invalid certificates to be treated as valid. (CVE-2013-5606) - An integer truncation error exists in the function 'PL_ArenaAllocate' in the Netscape Portable Runtime (NSPR) library. (CVE-2013-5607)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 70945
    published 2013-11-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70945
    title Firefox ESR 24.x < 24.1.1 NSS and NSPR Multiple Vulnerabilities (Mac OS X)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2013-266.NASL
    description A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741 , CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606)
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 71578
    published 2013-12-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71578
    title Amazon Linux AMI : nspr (ALAS-2013-266)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2013-270.NASL
    description Multiple security issues was identified and fixed in mozilla NSPR and NSS : Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure (CVE-2013-1739). Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large size value (CVE-2013-1741). The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext (CVE-2013-2566). Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets (CVE-2013-5605). The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate (CVE-2013-5606). Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741 (CVE-2013-5607). The NSPR packages has been upgraded to the 4.10.2 version and the NSS packages has been upgraded to the 3.15.3 version which is unaffected by these security flaws. Additionally the rootcerts packages has been upgraded with the latest certdata.txt file as of 2013/11/11 from mozilla.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 70998
    published 2013-11-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70998
    title Mandriva Linux Security Advisory : nss (MDVSA-2013:270)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_THUNDERBIRD_24_1_1.NASL
    description The installed version of Thunderbird is earlier than 24.1.1 and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to handling input greater than half the maximum size of the 'PRUint32' value. (CVE-2013-1741) - An error exists in the 'Null_Cipher' function in the file 'ssl/ssl3con.c' related to handling invalid handshake packets that could allow arbitrary code execution. (CVE-2013-5605) - An error exists in the 'CERT_VerifyCert' function in the file 'lib/certhigh/certvfy.c' that could allow invalid certificates to be treated as valid. (CVE-2013-5606) - An integer truncation error exists in the function 'PL_ArenaAllocate' in the Netscape Portable Runtime (NSPR) library. (CVE-2013-5607)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 71043
    published 2013-11-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71043
    title Thunderbird < 24.1 NSS and NSPR Multiple Vulnerabilities (Mac OS X)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1829.NASL
    description Updated nss, nspr, and nss-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605) It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739) An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607) It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate. (CVE-2013-5606) Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607. All NSS, NSPR, and nss-util users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, applications using NSS, NSPR, or nss-util must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-26
    plugin id 71390
    published 2013-12-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71390
    title RHEL 6 : nss, nspr, and nss-util (RHSA-2013:1829)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_25_0_1.NASL
    description The installed version of Firefox is a version prior to 25.0.1 and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to handling input greater than half the maximum size of the 'PRUint32' value. (CVE-2013-1741) - An error exists in the 'Null_Cipher' function in the file 'ssl/ssl3con.c' related to handling invalid handshake packets that could allow arbitrary code execution. (CVE-2013-5605) - An error exists in the 'CERT_VerifyCert' function in the file 'lib/certhigh/certvfy.c' that could allow invalid certificates to be treated as valid. (CVE-2013-5606) - An integer truncation error exists in the function 'PL_ArenaAllocate' in the Netscape Portable Runtime (NSPR) library. (CVE-2013-5607)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 70946
    published 2013-11-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70946
    title Firefox < 25.0.1 NSS and NSPR Multiple Vulnerabilities (Mac OS X)
redhat via4
advisories
  • bugzilla
    id 1031461
    title CVE-2013-5607 nspr: Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103)
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhsa:tst:20070055001
    • OR
      • AND
        • comment nspr is earlier than 0:4.10.2-2.el5_10
          oval oval:com.redhat.rhsa:tst:20131791002
        • comment nspr is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20081036022
      • AND
        • comment nspr-devel is earlier than 0:4.10.2-2.el5_10
          oval oval:com.redhat.rhsa:tst:20131791004
        • comment nspr-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20081036024
      • AND
        • comment nss is earlier than 0:3.15.3-3.el5_10
          oval oval:com.redhat.rhsa:tst:20131791006
        • comment nss is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080879012
      • AND
        • comment nss-devel is earlier than 0:3.15.3-3.el5_10
          oval oval:com.redhat.rhsa:tst:20131791012
        • comment nss-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080879016
      • AND
        • comment nss-pkcs11-devel is earlier than 0:3.15.3-3.el5_10
          oval oval:com.redhat.rhsa:tst:20131791010
        • comment nss-pkcs11-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080879014
      • AND
        • comment nss-tools is earlier than 0:3.15.3-3.el5_10
          oval oval:com.redhat.rhsa:tst:20131791008
        • comment nss-tools is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhsa:tst:20080879018
    rhsa
    id RHSA-2013:1791
    released 2013-12-05
    severity Important
    title RHSA-2013:1791: nss and nspr security, bug fix, and enhancement update (Important)
  • bugzilla
    id 1031461
    title CVE-2013-5607 nspr: Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103)
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhsa:tst:20100842001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhsa:tst:20100842002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhsa:tst:20100842003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhsa:tst:20100842004
    • OR
      • AND
        • comment nspr is earlier than 0:4.10.2-1.el6_5
          oval oval:com.redhat.rhsa:tst:20131829005
        • comment nspr is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111444023
      • AND
        • comment nspr-devel is earlier than 0:4.10.2-1.el6_5
          oval oval:com.redhat.rhsa:tst:20131829007
        • comment nspr-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20111444025
      • AND
        • comment nss-util is earlier than 0:3.15.3-1.el6_5
          oval oval:com.redhat.rhsa:tst:20131829009
        • comment nss-util is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100862016
      • AND
        • comment nss-util-devel is earlier than 0:3.15.3-1.el6_5
          oval oval:com.redhat.rhsa:tst:20131829011
        • comment nss-util-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100862018
      • AND
        • comment nss is earlier than 0:3.15.3-2.el6_5
          oval oval:com.redhat.rhsa:tst:20131829013
        • comment nss is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100862006
      • AND
        • comment nss-devel is earlier than 0:3.15.3-2.el6_5
          oval oval:com.redhat.rhsa:tst:20131829017
        • comment nss-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100862014
      • AND
        • comment nss-pkcs11-devel is earlier than 0:3.15.3-2.el6_5
          oval oval:com.redhat.rhsa:tst:20131829021
        • comment nss-pkcs11-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100862010
      • AND
        • comment nss-sysinit is earlier than 0:3.15.3-2.el6_5
          oval oval:com.redhat.rhsa:tst:20131829015
        • comment nss-sysinit is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100862008
      • AND
        • comment nss-tools is earlier than 0:3.15.3-2.el6_5
          oval oval:com.redhat.rhsa:tst:20131829019
        • comment nss-tools is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20100862012
    rhsa
    id RHSA-2013:1829
    released 2013-12-12
    severity Important
    title RHSA-2013:1829: nss, nspr, and nss-util security update (Important)
rpms
  • nspr-0:4.10.2-2.el5_10
  • nspr-devel-0:4.10.2-2.el5_10
  • nss-0:3.15.3-3.el5_10
  • nss-devel-0:3.15.3-3.el5_10
  • nss-pkcs11-devel-0:3.15.3-3.el5_10
  • nss-tools-0:3.15.3-3.el5_10
  • nspr-0:4.10.2-1.el6_5
  • nspr-devel-0:4.10.2-1.el6_5
  • nss-util-0:3.15.3-1.el6_5
  • nss-util-devel-0:3.15.3-1.el6_5
  • nss-0:3.15.3-2.el6_5
  • nss-devel-0:3.15.3-2.el6_5
  • nss-pkcs11-devel-0:3.15.3-2.el6_5
  • nss-sysinit-0:3.15.3-2.el6_5
  • nss-tools-0:3.15.3-2.el6_5
refmap via4
bid 63802
confirm
debian DSA-2820
gentoo
  • GLSA-201406-19
  • GLSA-201504-01
mlist [dev-tech-nspr] 20131113 [ANNOUNCE] NSPR 4.10.2 Release
suse
  • SUSE-SU-2013:1807
  • openSUSE-SU-2013:1732
ubuntu
  • USN-2031-1
  • USN-2032-1
  • USN-2087-1
Last major update 30-12-2016 - 21:59
Published 20-11-2013 - 09:12
Last modified 08-01-2018 - 21:29
Back to Top