CVE-2017-5462

A flaw in DRBG number generation within the Network Security Services NSS library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerabili...

Critical: Red Hat Security Advisory: nss and nss-util security update

An update for nss and nss-util is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Critical: Red Hat Security Advisory: nss-util security update

An update for nss-util is now available for Red Hat Enterprise Linux 6.2 Advanced Update Support, Red Hat Enterprise Linux 6.4 Advanced Update Support, Red Hat Enterprise Linux 6.5 Advanced Update Support, Red Hat Enterprise Linux 6.5 Telco Extended Update Support, Red Hat Enterprise Linux 6.6...

nss: Write beyond bounds caused by bugs in Base64 de/encoding in nssb64d.c and nssb64e.c (MFSA 2017-10)

An out-of-bounds write flaw was found in the way NSS performed certain Base64-decoding operations. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash or execute arbitrary code, using the permissions of the user running an...

[ASA-201704-4] nss: arbitrary code execution

Arch Linux Security Advisory ASA-201704-4 ========================================= Severity: Critical Date : 2017-04-20 CVE-ID : CVE-2017-5461 Package : nss Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-247 Summary ======= The package nss before version...

CVE-2017-5462

A flaw in DRBG number generation within the Network Security Services NSS library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerabili...

RHEL 6 / 7 : nss and nss-util (RHSA-2017:1100)

An update for nss and nss-util is now available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

nss and nss-util security update

nss 3.28.4-1.0.1 - Added nss-vendor.patch to change vendor - Temporarily disable some tests until expired PayPalEE.cert is renewed 3.28.4-1 - Rebase to 3.28.4 nss-util 3.28.4-1 - Rebase to NSS 3.28.4 to accommodate base64 encoding fix...

CVE-2017-5461

Mozilla Network Security Services NSS before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service out-of-bounds write or possibly have unspecified other impact by leveraging incorrect base64 operations...

Security fix for the ALT Linux 10 package firefox-esr version 45.9.0-alt1

April 20, 2017 Andrey Cherepanov 45.9.0-alt1 - New ESR version - Security fixes: + CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, + CVE-2017-5462: DRBG flaw in NSS + CVE-2017-5445: Uninitialized values used while parsing + CVE-2017-5469: Potential Buffer overflow in...

RHEL 5 : nss (RHSA-2017:1103)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1103 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

RHEL 6 / 7 : nss-util (RHSA-2017:1102)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1102 advisory. The nss-util packages provide utilities for use with the Network Security Services NSS libraries. Security Fixes: An out-of-bounds write flaw was...

Security vulnerabilities fixed in Firefox ESR 52.1 — Mozilla

A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. A use-after-free vulnerability occurs during transaction processing in t...

Security vulnerabilities fixed in Firefox ESR 45.9 — Mozilla

A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller while still in use. This results in a potentially exploitable crash. A use-after-free vulnerability occurs during transaction processing in t...

BSA-2017-216

Security Advisory ID : BSA-2017-216 Component : libcurl Revision : 1.0: Interim curl andlibcurlbefore 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loade...

OracleVM 3.3 / 3.4 : curl (OVMSA-2017-0059)

The remote OracleVM system is missing necessary patches to address critical security updates : - treat Negotiate authentication as connection-oriented CVE-2017-2628 - fix a bug in DNS caching code that causes a memory leak 1302893 - SSH: make CURLOPTSSHPUBLICKEYFILE treat '' as NULL 1260742 - use...

MGASA-2017-0081 Updated firefox packages fix security vulnerability

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402,...

Updated firefox packages fix security vulnerability

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox CVE-2017-5398, CVE-2017-5400, CVE-2017-5401, CVE-2017-5402,...

NSS -- multiple vulnerabilities

Mozilla Foundation reports: An out-of-bounds write during Base64 decoding operation in the Network Security Services NSS library due to insufficient memory being allocated to the buffer. This results in a potentially exploitable crash. The NSS library has been updated to fix this issue to address...

nss: Crash in fexpand

Project: https://hg.mozilla.org/projects/nss Detailed report: https://oss-fuzz.com/testcase?key=6677346901819392 Project: nss Fuzzer: libFuzzernsstls-server Fuzz target binary: tls-server Job Type: libfuzzerasannss Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x604000030000 Crash...