ID CVE-2014-1545
Summary Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
References
Vulnerable Configurations
  • Mozilla Netscape Portable Runtime (NSPR) 4.1.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.1.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.1.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.1.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.2.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.2.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.4.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.4.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.5.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.5.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.4
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.4
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.5
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.5
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.7
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.7
  • Mozilla Netscape Portable Runtime (NSPR) 4.6.8
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.8
  • Mozilla Netscape Portable Runtime (NSPR) 4.7
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.4
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.4
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.5
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.5
  • Mozilla Netscape Portable Runtime (NSPR) 4.7.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.8
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.4
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.4
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.5
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.5
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.7
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.7
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.8
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.8
  • Mozilla Netscape Portable Runtime (NSPR) 4.8.9
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.9
  • Mozilla Netscape Portable Runtime (NSPR) 4.9
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.4
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.4
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.5
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.5
  • Mozilla Netscape Portable Runtime (NSPR) 4.9.6
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.6
  • Mozilla Netscape Portable Runtime (NSPR) 4.10
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10
  • Mozilla Netscape Portable Runtime (NSPR) 4.10.1
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.1
  • Mozilla Netscape Portable Runtime (NSPR) 4.10.2
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.2
  • Mozilla Netscape Portable Runtime (NSPR) 4.10.3
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.3
  • Mozilla Netscape Portable Runtime (NSPR) 4.10.4
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.4
  • Mozilla Netscape Portable Runtime (NSPR) 4.10.5
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.5
CVSS
Base: 10.0 (as of 13-08-2015 - 07:51)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-432.NASL
    description mozilla-nspr was updated to version 4.10.6 to fix one security issue : - OOB write with sprintf and console functions (CVE-2014-1545) MozillaFirefox was updated to version 30.0 to fix eight security issues : - Miscellaneous memory safety hazards (CVE-2014-1533/CVE-2014-1534) - Use-after-free and out of bounds issues found using Address Sanitizer (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538) - Use-after-free in Event Listener Manager (CVE-2014-1540) - Use-after-free with SMIL Animation Controller (CVE-2014-1541) - Buffer overflow in Web Audio Speex resampler (CVE-2014-1542) Several non-security bugs were also fixed in this release.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 76181
    published 2014-06-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76181
    title openSUSE Security Update : MozillaFirefox / mozilla-nspr (openSUSE-SU-2014:0819-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2962.NASL
    description Abhiskek Arya discovered an out of bounds write in the cvt_t() function of the NetScape Portable Runtime Library which could result in the execution of arbitrary code.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 76090
    published 2014-06-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76090
    title Debian DSA-2962-1 : nspr - security update
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2265-1.NASL
    description Abhishek Arya discovered that NSPR incorrectly handled certain console functions. A remote attacker could use this issue to cause NSPR to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 76354
    published 2014-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76354
    title Ubuntu 10.04 LTS / 12.04 LTS / 13.10 / 14.04 LTS : nspr vulnerability (USN-2265-1)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-32.NASL
    description Abhiskek Arya discovered an out of bounds write in the cvt_t() function of the NetScape Portable Runtime Library which could result in the execution of arbitrary code. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-07-06
    plugin id 82180
    published 2015-03-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82180
    title Debian DLA-32-1 : nspr security update
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2014-384.NASL
    description Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
    last seen 2019-02-21
    modified 2018-04-18
    plugin id 78327
    published 2014-10-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78327
    title Amazon Linux AMI : nspr (ALAS-2014-384)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2955.NASL
    description Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 74476
    published 2014-06-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74476
    title Debian DSA-2955-1 : iceweasel - security update
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2014-125.NASL
    description A vulnerability has been discovered and corrected in nspr : Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions (CVE-2014-1545). The updated nspr packages have been upgraded to the 4.10.6 version which is unaffected by this issue. Additionally : - The rootcerts package have been upgraded to the latest version as of 2014-04-01. - The nss packages have been upgraded to the latest 3.16.1 version which resolves various bugs. - The sqlite3 packages have been upgraded to the 3.7.17 version for mbs1 due to an prerequisite to nss-3.16.1.
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 76068
    published 2014-06-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76068
    title Mandriva Linux Security Advisory : nspr (MDVSA-2014:125)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2960.NASL
    description Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 76081
    published 2014-06-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76081
    title Debian DSA-2960-1 : icedove - security update
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_888A0262F0D911E3BA0CB4B52FCE4CE8.NASL
    description The Mozilla Project reports : MFSA 2014-48 Miscellaneous memory safety hazards (rv:30.0 / rv:24.6) MFSA 2014-49 Use-after-free and out of bounds issues found using Address Sanitizer MFSA 2014-51 Use-after-free in Event Listener Manager MFSA 2014-52 Use-after-free with SMIL Animation Controller MFSA 2014-53 Buffer overflow in Web Audio Speex resampler MFSA 2014-54 Buffer overflow in Gamepad API MFSA 2014-55 Out of bounds write in NSPR
    last seen 2019-02-21
    modified 2018-11-21
    plugin id 74444
    published 2014-06-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74444
    title FreeBSD : mozilla -- multiple vulnerabilities (888a0262-f0d9-11e3-ba0c-b4b52fce4ce8)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-448.NASL
    description seamonkey was updated to version 2.26.1 to fix nine security issues. These security issues were fixed : - Miscellaneous memory safety hazards (CVE-2014-1533/CVE-2014-1534) - Use-after-free and out of bounds issues found using Address Sanitizer (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538) - Use-after-free in Event Listener Manager (CVE-2014-1540) - Use-after-free with SMIL Animation Controller (CVE-2014-1541) - Buffer overflow in Web Audio Speex resampler (CVE-2014-1542) - Out of bounds write in NSPR (CVE-2014-1545)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 76339
    published 2014-07-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76339
    title openSUSE Security Update : seamonkey (openSUSE-SU-2014:0855-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-0917.NASL
    description From Red Hat Security Advisory 2014:0917 : Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544) A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1544, CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber as the original reporters of CVE-2014-1544, Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. In addition, the nss package has been upgraded to upstream version 3.16.1, and the nspr package has been upgraded to upstream version 4.10.6. These updated packages provide a number of bug fixes and enhancements over the previous versions. (BZ#1112136, BZ#1112135) Users of NSS and NSPR are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 76694
    published 2014-07-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76694
    title Oracle Linux 6 : nspr / nss (ELSA-2014-0917)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2015-059.NASL
    description Multiple vulnerabilities has been found and corrected in the Mozilla NSS and NSPR packages : The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate (CVE-2014-1492). Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544). Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a signature malleability issue (CVE-2014-1568). The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00 (CVE-2014-1569). Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions (CVE-2014-1545). The sqlite3 packages have been upgraded to the 3.8.6 version due to an prerequisite to nss-3.17.x. Additionally the rootcerts package has also been updated to the latest version as of 2014-11-17, which adds, removes, and distrusts several certificates. The updated packages provides a solution for these security issues.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 81942
    published 2015-03-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=81942
    title Mandriva Linux Security Advisory : nss (MDVSA-2015:059)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-1246.NASL
    description Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs : * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as 'grep', could not handle failures properly. This update improves error detection in the specification file, and 'grep' and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 77993
    published 2014-10-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77993
    title CentOS 5 : nss (CESA-2014:1246)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_FIREFOX-2014-06-140612.NASL
    description Mozilla Firefox was updated to version 24.6.0 to fix six security issues : - Miscellaneous memory safety hazards. (CVE-2014-1533 / CVE-2014-1534) - Use-after-free and out of bounds issues found using Address Sanitizer. (CVE-2014-1536 / CVE-2014-1537 / CVE-2014-1538) - Use-after-free with SMIL Animation Controller. (CVE-2014-1541) mozilla-nspr was updated to version 4.10.6 to fix one security issue : - Out of bounds write in NSPR. (CVE-2014-1545) Further information can be found at https://www.mozilla.org/security/announce/ .
    last seen 2019-02-21
    modified 2014-07-26
    plugin id 76188
    published 2014-06-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76188
    title SuSE 11.3 Security Update : MozillaFirefox (SAT Patch Number 9370)
  • NASL family F5 Networks Local Security Checks
    NASL id F5_BIGIP_SOL16716.NASL
    description CVE-2013-1740 The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic. CVE-2014-1490 Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket. CVE-2014-1491 Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value. CVE-2014-1492 The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is iframeded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate. CVE-2014-1544 Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain. CVE-2014-1545 Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
    last seen 2019-02-21
    modified 2019-01-04
    plugin id 91202
    published 2016-05-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=91202
    title F5 Networks BIG-IP : Multiple Mozilla NSS vulnerabilities (K16716)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2014-1246.NASL
    description From Red Hat Security Advisory 2014:1246 : Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs : * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as 'grep', could not handle failures properly. This update improves error detection in the specification file, and 'grep' and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 77739
    published 2014-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77739
    title Oracle Linux 5 : nspr / nss (ELSA-2014-1246)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20140722_NSS_AND_NSPR_ON_SL6_X.NASL
    description A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544) A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) In addition, the nss package has been upgraded to upstream version 3.16.1, and the nspr package has been upgraded to upstream version 4.10.6. These updated packages provide a number of bug fixes and enhancements over the previous versions. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 76702
    published 2014-07-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76702
    title Scientific Linux Security Update : nss and nspr on SL6.x i386/x86_64
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-447.NASL
    description MozillaThunderbird was updated to version 24.6.0 to fix six security issues : - Miscellaneous memory safety hazards (CVE-2014-1533/CVE-2014-1534) - Use-after-free and out of bounds issues found using Address Sanitizer (CVE-2014-1536/CVE-2014-1537/CVE-2014-1538) - Use-after-free with SMIL Animation Controller (CVE-2014-1541)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 76338
    published 2014-07-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76338
    title openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2014:0858-1)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201504-01.NASL
    description The remote host is affected by the vulnerability described in GLSA-201504-01 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact. Workaround : There are no known workarounds at this time.
    last seen 2019-02-21
    modified 2016-11-11
    plugin id 82632
    published 2015-04-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=82632
    title GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-1246.NASL
    description Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs : * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as 'grep', could not handle failures properly. This update improves error detection in the specification file, and 'grep' and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements.
    last seen 2019-02-21
    modified 2018-12-14
    plugin id 77699
    published 2014-09-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77699
    title RHEL 5 : nss and nspr (RHSA-2014:1246)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20140916_NSS_AND_NSPR_ON_SL5_X.NASL
    description A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. This update also fixes the following bugs : - Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as 'grep', could not handle failures properly. This update improves error detection in the specification file, and 'grep' and other utilities now handle missing files or crashes as intended. - Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. - Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Scientific Linux 5.
    last seen 2019-02-21
    modified 2018-12-28
    plugin id 77955
    published 2014-09-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=77955
    title Scientific Linux Security Update : nss and nspr on SL5.x i386/x86_64
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2014-0917.NASL
    description Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544) A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1544, CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber as the original reporters of CVE-2014-1544, Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. In addition, the nss package has been upgraded to upstream version 3.16.1, and the nspr package has been upgraded to upstream version 4.10.6. These updated packages provide a number of bug fixes and enhancements over the previous versions. (BZ#1112136, BZ#1112135) Users of NSS and NSPR are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 76698
    published 2014-07-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76698
    title RHEL 6 : nss and nspr (RHSA-2014:0917)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2014-0917.NASL
    description Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544) A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1544, CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber as the original reporters of CVE-2014-1544, Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. In addition, the nss package has been upgraded to upstream version 3.16.1, and the nspr package has been upgraded to upstream version 4.10.6. These updated packages provide a number of bug fixes and enhancements over the previous versions. (BZ#1112136, BZ#1112135) Users of NSS and NSPR are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 76686
    published 2014-07-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=76686
    title CentOS 6 : nspr / nss / nss-util (CESA-2014:0917)
redhat via4
advisories
  • bugzilla
    id 1174527
    title Segfault in pk12util when using -l option with certain .p12 files
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 7 Client is installed
        oval oval:com.redhat.rhba:tst:20150364001
      • comment Red Hat Enterprise Linux 7 Server is installed
        oval oval:com.redhat.rhba:tst:20150364002
      • comment Red Hat Enterprise Linux 7 Workstation is installed
        oval oval:com.redhat.rhba:tst:20150364003
      • comment Red Hat Enterprise Linux 7 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20150364004
    • OR
      • AND
        • comment nspr is earlier than 0:4.10.6-3.el7
          oval oval:com.redhat.rhba:tst:20150364005
        • comment nspr is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364006
      • AND
        • comment nspr-devel is earlier than 0:4.10.6-3.el7
          oval oval:com.redhat.rhba:tst:20150364007
        • comment nspr-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364008
      • AND
        • comment nss is earlier than 0:3.16.2.3-5.el7
          oval oval:com.redhat.rhba:tst:20150364009
        • comment nss is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364010
      • AND
        • comment nss-devel is earlier than 0:3.16.2.3-5.el7
          oval oval:com.redhat.rhba:tst:20150364015
        • comment nss-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364016
      • AND
        • comment nss-pkcs11-devel is earlier than 0:3.16.2.3-5.el7
          oval oval:com.redhat.rhba:tst:20150364017
        • comment nss-pkcs11-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364018
      • AND
        • comment nss-sysinit is earlier than 0:3.16.2.3-5.el7
          oval oval:com.redhat.rhba:tst:20150364013
        • comment nss-sysinit is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364014
      • AND
        • comment nss-tools is earlier than 0:3.16.2.3-5.el7
          oval oval:com.redhat.rhba:tst:20150364011
        • comment nss-tools is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364012
      • AND
        • comment nss-util is earlier than 0:3.16.2.3-2.el7
          oval oval:com.redhat.rhba:tst:20150364019
        • comment nss-util is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364020
      • AND
        • comment nss-util-devel is earlier than 0:3.16.2.3-2.el7
          oval oval:com.redhat.rhba:tst:20150364021
        • comment nss-util-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364022
      • AND
        • comment nss-softokn is earlier than 0:3.16.2.3-9.el7
          oval oval:com.redhat.rhba:tst:20150364023
        • comment nss-softokn is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364024
      • AND
        • comment nss-softokn-devel is earlier than 0:3.16.2.3-9.el7
          oval oval:com.redhat.rhba:tst:20150364025
        • comment nss-softokn-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364026
      • AND
        • comment nss-softokn-freebl is earlier than 0:3.16.2.3-9.el7
          oval oval:com.redhat.rhba:tst:20150364027
        • comment nss-softokn-freebl is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364028
      • AND
        • comment nss-softokn-freebl-devel is earlier than 0:3.16.2.3-9.el7
          oval oval:com.redhat.rhba:tst:20150364029
        • comment nss-softokn-freebl-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364030
    rhsa
    released 2015-03-05
    severity None
    title RHBA-2015:0364: nss, nss-softokn, nss-util, and nspr bug fix and enhancement update (None)
  • bugzilla
    id 1116198
    title CVE-2014-1544 nss: Race-condition in certificate verification can lead to Remote code execution (MFSA 2014-63)
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhba:tst:20111656001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhba:tst:20111656002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20111656004
    • OR
      • AND
        • comment nspr is earlier than 0:4.10.6-1.el6_5
          oval oval:com.redhat.rhsa:tst:20140917005
        • comment nspr is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364006
      • AND
        • comment nspr-devel is earlier than 0:4.10.6-1.el6_5
          oval oval:com.redhat.rhsa:tst:20140917007
        • comment nspr-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364008
      • AND
        • comment nss-util is earlier than 0:3.16.1-1.el6_5
          oval oval:com.redhat.rhsa:tst:20140917009
        • comment nss-util is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364020
      • AND
        • comment nss-util-devel is earlier than 0:3.16.1-1.el6_5
          oval oval:com.redhat.rhsa:tst:20140917011
        • comment nss-util-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364022
      • AND
        • comment nss is earlier than 0:3.16.1-4.el6_5
          oval oval:com.redhat.rhsa:tst:20140917013
        • comment nss is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364010
      • AND
        • comment nss-devel is earlier than 0:3.16.1-4.el6_5
          oval oval:com.redhat.rhsa:tst:20140917021
        • comment nss-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364016
      • AND
        • comment nss-pkcs11-devel is earlier than 0:3.16.1-4.el6_5
          oval oval:com.redhat.rhsa:tst:20140917015
        • comment nss-pkcs11-devel is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364018
      • AND
        • comment nss-sysinit is earlier than 0:3.16.1-4.el6_5
          oval oval:com.redhat.rhsa:tst:20140917017
        • comment nss-sysinit is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364014
      • AND
        • comment nss-tools is earlier than 0:3.16.1-4.el6_5
          oval oval:com.redhat.rhsa:tst:20140917019
        • comment nss-tools is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhba:tst:20150364012
    rhsa
    id RHSA-2014:0917
    released 2014-07-22
    severity Critical
    title RHSA-2014:0917: nss and nspr security, bug fix, and enhancement update (Critical)
  • bugzilla
    id 1110860
    title Rebase nss in RHEL 5.11 to NSS 3.16.1 (required for FF 31)
    oval
    AND
    • comment Red Hat Enterprise Linux 5 is installed
      oval oval:com.redhat.rhba:tst:20070331001
    • OR
      • AND
        • comment nss is earlier than 0:3.16.1-2.el5
          oval oval:com.redhat.rhsa:tst:20141246002
        • comment nss is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhba:tst:20150925013
      • AND
        • comment nss-devel is earlier than 0:3.16.1-2.el5
          oval oval:com.redhat.rhsa:tst:20141246004
        • comment nss-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhba:tst:20150925009
      • AND
        • comment nss-pkcs11-devel is earlier than 0:3.16.1-2.el5
          oval oval:com.redhat.rhsa:tst:20141246008
        • comment nss-pkcs11-devel is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhba:tst:20150925007
      • AND
        • comment nss-tools is earlier than 0:3.16.1-2.el5
          oval oval:com.redhat.rhsa:tst:20141246006
        • comment nss-tools is signed with Red Hat redhatrelease key
          oval oval:com.redhat.rhba:tst:20150925011
    rhsa
    id RHSA-2014:1246
    released 2014-09-16
    severity Moderate
    title RHSA-2014:1246: nss and nspr security, bug fix, and enhancement update (Moderate)
rpms
  • nspr-0:4.10.6-3.el7
  • nspr-devel-0:4.10.6-3.el7
  • nss-0:3.16.2.3-5.el7
  • nss-devel-0:3.16.2.3-5.el7
  • nss-pkcs11-devel-0:3.16.2.3-5.el7
  • nss-sysinit-0:3.16.2.3-5.el7
  • nss-tools-0:3.16.2.3-5.el7
  • nss-util-0:3.16.2.3-2.el7
  • nss-util-devel-0:3.16.2.3-2.el7
  • nss-softokn-0:3.16.2.3-9.el7
  • nss-softokn-devel-0:3.16.2.3-9.el7
  • nss-softokn-freebl-0:3.16.2.3-9.el7
  • nss-softokn-freebl-devel-0:3.16.2.3-9.el7
  • nspr-0:4.10.6-1.el6_5
  • nspr-devel-0:4.10.6-1.el6_5
  • nss-util-0:3.16.1-1.el6_5
  • nss-util-devel-0:3.16.1-1.el6_5
  • nss-0:3.16.1-4.el6_5
  • nss-devel-0:3.16.1-4.el6_5
  • nss-pkcs11-devel-0:3.16.1-4.el6_5
  • nss-sysinit-0:3.16.1-4.el6_5
  • nss-tools-0:3.16.1-4.el6_5
  • nss-0:3.16.1-2.el5
  • nss-devel-0:3.16.1-2.el5
  • nss-pkcs11-devel-0:3.16.1-2.el5
  • nss-tools-0:3.16.1-2.el5
refmap via4
bid 67975
confirm
debian
  • DSA-2955
  • DSA-2960
  • DSA-2962
gentoo GLSA-201504-01
sectrack 1030404
secunia
  • 58984
  • 59229
  • 59275
  • 59318
  • 59377
  • 59387
  • 59425
  • 59486
  • 59614
suse
  • SUSE-SU-2014:0824
  • openSUSE-SU-2014:0797
  • openSUSE-SU-2014:0819
  • openSUSE-SU-2014:0855
  • openSUSE-SU-2014:0858
ubuntu USN-2265-1
Last major update 06-01-2017 - 21:59
Published 11-06-2014 - 06:57
Last modified 27-12-2017 - 21:29
Back to Top