Moderate: Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

An update for nss and nspr is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

nss: Use-after-free in sftk_FreeSession due to improper refcounting

A use-after-free flaw was found in Mozilla Network Security Services NSS related to PK11 session handling. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled with NSS...

nss: Timing attack on DSA signature generation

A flaw was found in the DSA signature generation function in nss. During the process of generating a DSA signature, the nonce value 'k' is not padded, exposing the bit length. Combined with other techniques, this can result in the recovery of the DSA private key. The highest threat from this...

nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state

A protocol downgrade flaw was found in Network Security Services NSS. After a HelloRetryRequest has been sent, the client may negotiate a lower protocol than TLS 1.3, resulting in an invalid state transition in the TLS State Machine. If the client gets into this state, incoming Application Data...

nss: Side channel vulnerabilities during RSA key generation

A flaw was found in NSS, where it is vulnerable to RSA key generation cache timing side-channel attacks. An attacker with sufficient access to mount cache timing attacks during the RSA key generation process could recover the private key. The highest threat to this flaw is to confidentiality...

RLSA-2020:3280 Moderate: nss and nspr security, bug fix, and enhancement update

Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime NSPR provides platform independence for non-GUI operating system facilities. The following packages have been upgrad...

Debian DLA-2305-1 : transmission security update

Use-after-free in libtransmission/variant.c in Transmission before 3.00 allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted torrent file. For Debian 9 stretch, this problem has been fixed in version 2.92-2+deb9u2. We recommend that you upgra...

Debian DLA-2304-1 : libpam-radius-auth security update

addpassword in pamradiusauth.c in pamradius 1.4.0 does not correctly check the length of the input password, and is vulnerable to a stack-based buffer overflow during memcpy. An attacker could send a crafted password to an application loading the pamradius library and crash it. Arbitrary code...

Fedora 32 : clamav (2020-6584a641ae)

ClamAV 0.102.4 is a bug patch release to address the following issues : CVE-2020-3350 Fixed a vulnerability a malicious user could exploit to replace a scan target's directory with a symlink to another path to trick clamscan, clamdscan, or clamonacc into removing or moving a different file such a...

Fedora 31 : glibc (2020-4e92a61688)

This update incorporates fixes from the upstream glibc 2.30 stable release branch, including a fix for a medium severity security vulnerability. CVE-2020-6096 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable h...

Fedora 31 : chromium (2020-84d87cbd50)

Just enough time for one more update. Chromium 84. Fixes CVE-2020-6510 CVE-2020-6511 CVE-2020-6512 CVE-2020-6513 CVE-2020-6514 CVE-2020-6515 CVE-2020-6516 CVE-2020-6517 CVE-2020-6518 CVE-2020-6519 CVE-2020-6520 CVE-2020-6521 CVE-2020-6522 CVE-2020-6523 CVE-2020-6524 CVE-2020-6525 CVE-2020-6526...

Fedora: Security Advisory for nss (FEDORA-2020-16741ac7ff)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 31 Update: nss-3.54.0-1.fc31

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

Fedora 31 : python38 (2020-bb919e575e)

Python 3.8.5 security update. Contains security fix fro CVE-2019-20907. Full changelog. ---- Security fix for CVE-2020-14422 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clea...

Fedora 31 : python39 (2020-aab24d3714)

Python 3.9.0b5 update. Contains security fix for CVE-2019-20907. Full changelog. Large autogenerated modules pydocdata and several encodings are now present as pyc optimization 0 files only. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Fedora 32 : systemd (2020-2faf839786)

Contains a bunch of patches for the assorted linked bugzillas. Handling of user names that resemble numerical uids is tightened CVE-2020-13776. The hardware database is updated to the upstream version. Note that Tenable Network Security has extracted the preceding description block directly from...

EulerOS 2.0 SP8 : ntp (EulerOS-SA-2020-1817)

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet...

SUSE SLED15 / SLES15 Security Update : grub2 (SUSE-SU-2020:2077-1)

This update for grub2 fixes the following issues : CVE-2020-10713 bsc1168994 CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 bsc1173812 CVE-2020-15706 bsc1174463 CVE-2020-15707 bsc1174570 Use overflow checking primitives where the arithmetic expression for buffer allocations may...

EulerOS 2.0 SP8 : ant (EulerOS-SA-2020-1794)

According to the version of the ant packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several...

Debian DLA-2295-1 : curl security update

A vulnerbailty was found in curl, a command line tool for transferring data with URL syntax. When using when using -J --remote-header-name and -i --include in the same command line, a malicious server could force curl to overwrite the contents of local files with incoming HTTP headers. For Debian...