CVE-2014-1569

The definitelengthdecoder function in lib/util/quickder.c in Mozilla Network Security Services NSS before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long...

FreeBSD : mozilla -- multiple vulnerabilities (7ae61870-9dd2-4884-a2f2-f19bb5784d09)

The Mozilla Project reports : ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer...

Mozilla Thunderbird < 31.3

The version of Thunderbird installed on the remote Windows host is prior to 31.3. It is, therefore, affected by a vulnerability as referenced in the mfsa2014-90 advisory. - jemalloc poisoning plus Apple uninitialized variable usage triggers keylogging in /tmp/ on OSX 10.10CVE-2014-1595...

mozilla -- multiple vulnerabilities

The Mozilla Project reports: ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data MFSA-2014-90 Apple CoreGraphics framework on OS X 10.10 logging input data to /tmp directory MFSA-2014-89 Bad casting from the BasicThebesLayer to BasicContainerLayer...

OracleVM 2.1 : krb5 (OVMSA-2009-0003)

The remote OracleVM system is missing necessary patches to address critical security updates : CVE-2009-0844 The getinputtoken function in the SPNEGO implementation in MIT Kerberos 5 aka krb5 1.5 through 1.6.3 allows remote attackers to cause a denial of service daemon crash and possibly obtain...

Pidgin libpurple Mxit Emoticon ASN Length Denial of Service Vulnerability

Talos Vulnerability Report VRT-2014-0203 Pidgin libpurple Mxit Emoticon ASN Length Denial of Service Vulnerability November 6, 2014 CVE Number CVE-2014-3695 Description An exploitable denial of service vulnerability exists in Pidgin’s implementation of the Mxit protocol in the libpurple library. ...

Mozilla Network Security Services RSA Signature Forgery (CVE-2014-1568)

An RSA signature forgery vulnerability exists in Mozilla Network Security Services NSS, the cryptographic library used in many applications including Firefox and Google Chrome. The vulnerability is a result of improper verification of RSA signatures due to incorrect ASN.1 parsing of the DigestInf...

CVE-2014-4443

Apple OS X before 10.10 allows remote attackers to cause a denial of service NULL pointer dereference via crafted ASN.1 data...

Null pointer dereference

Apple OS X before 10.10 allows remote attackers to cause a denial of service NULL pointer dereference via crafted ASN.1 data...

CVE-2014-4443

CVE-2014-4443 affects Apple macOS X prior to 10.10. The vulnerability is a remote denial of service via a NULL pointer dereference when handling crafted ASN.1 data. The issue is rooted in how ASN.1 data is processed, allowing an attacker to induce a crash without requiring user interaction. Impac...

CVE-2014-4443

Apple OS X before 10.10 allows remote attackers to cause a denial of service NULL pointer dereference via crafted ASN.1 data...

Amazon Linux AMI : nss-softokn (ALAS-2014-423)

A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. C Tenable Network Security, Inc. The descriptive tex...

nss: RSA PKCS#1 signature verification forgery flaw (MFSA 2014-73)

A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS...

Debian Security Advisory DSA 3033-1 (nss - security update)

Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craft ASN.1 data to forge RSA certificates with a valid certification...

Important: nss-softokn

Issue Overview: A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. Affected Packages: nss-softokn Issue...

Debian Security Advisory DSA 3034-1 (iceweasel - security update)

Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library, embedded in Wheezy OpenVAS Vulnerability Test $Id: deb3034.nasl 6637 2017-07-10 09:58:13Z teissa $ Auto-generated from advisory DSA 3034-1 using nvtgen 1.0 Script version: 1.0 Autho...

Important: nss

Issue Overview: A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. Affected Packages: nss Issue...

openSUSE: Security Advisory for mozilla-nss (openSUSE-SU-2014:1232-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-3037-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Seamonkey RSA Spoof Vulnerability (Sep 2014) - Mac OS X

Mozilla Seamonkey is prone to spoof vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:seamonkey";...