Red Hat Security AdvisoryRHSA-2014:0917
nss and nspr security, bug fix, and enhancement update
Released 2014-07-22 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) nspr-4.10.6-1.el6_5, nss-3.16.1-4.el6_5, nss-sysinit-3.16.1-4.el6_5 +2
- Red Hat Enterprise Linux Desktop Optional (v. 6) nspr-4.10.6-1.el6_5, nspr-devel-4.10.6-1.el6_5, nss-3.16.1-4.el6_5 +4
- Red Hat Enterprise Linux HPC Node (v. 6) nspr-4.10.6-1.el6_5, nss-3.16.1-4.el6_5, nss-sysinit-3.16.1-4.el6_5 +2
- Red Hat Enterprise Linux HPC Node Optional (v. 6) nspr-4.10.6-1.el6_5, nspr-devel-4.10.6-1.el6_5, nss-3.16.1-4.el6_5 +4
- Red Hat Enterprise Linux Server (v. 6) nspr-4.10.6-1.el6_5, nspr-4.10.6-1.el6_5.ppc, nspr-devel-4.10.6-1.el6_5 +11
- Red Hat Enterprise Linux Server Optional (v. 6) nss-3.16.1-4.el6_5, nss-pkcs11-devel-3.16.1-4.el6_5, nss-pkcs11-devel-3.16.1-4.el6_5.ppc
- Red Hat Enterprise Linux Workstation (v. 6) nspr-4.10.6-1.el6_5, nspr-devel-4.10.6-1.el6_5, nss-3.16.1-4.el6_5 +5
- Red Hat Enterprise Linux Workstation Optional (v. 6) nss-3.16.1-4.el6_5, nss-pkcs11-devel-3.16.1-4.el6_5
Fixes 6 records
Priority MEDIUM 52
Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.06329 · Published 2014-06-11 · Fixed
Priority MEDIUM 52
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.06109 · Published 2014-07-23 · Fixed
Priority MEDIUM 47
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products,…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.03904 · Published 2014-02-06 · Partial fix CWE-362
Priority LOW 29
The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by us…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.01664 · Published 2014-01-18 · Fixed CWE-310
Priority LOW 27
Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.04601 · Published 2014-02-06 · Fixed CWE-326
Priority LOW 24
The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalize…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01753 · Published 2014-03-25 · Fixed CWE-20
THREATIST.IORead the docs