Firefox ESR 24.x < 24.8.1 NSS Signature Verification Vulnerability (Mac OS X)

The version of Firefox ESR 24.x installed on the remote host is prior to 24.8.1. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Mandriva Linux Security Advisory : nss (MDVSA-2014:189)

A vulnerability has been discovered and corrected in Mozilla NSS : Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services NSS libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature...

RHEL 5 / 6 / 7 : nss (RHSA-2014:1307)

Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Firefox < 32.0.3 NSS Signature Verification Vulnerability

The version of Firefox installed on the remote host is prior to 32.0.3. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL certificate...

FreeBSD : NSS -- RSA Signature Forgery (48108fb0-751c-4cbb-8f33-09239ead4b55)

The Mozilla Project reports : Antoine Delignat-Lavaud discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificate...

Debian DSA-3034-1 : iceweasel - security update

Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library, embedded in Wheezy's Iceweasel package, was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craft ASN.1 data to forge RS...

SeaMonkey < 2.29.1 NSS Signature Verification Vulnerability

The version of SeaMonkey installed on the remote host is prior to 2.29.1. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Debian DSA-3033-1 : nss - security update

Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craft ASN.1 data to forge RSA certificates with a valid certification...

CVE-2014-1568

Mozilla Network Security Services NSS before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1...

CVE-2014-1568

Mozilla Network Security Services NSS before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1...

CVE-2014-1568

CVE-2014-1568 covers NSS (and libraries using NSS) where ASN.1 parsing of DigestInfo in X.509 certificates is faulty, enabling remote attackers to forge RSA signatures via crafted certs. Affected NSS/products include NSS itself and Mozilla stack components (Firefox, Thunderbird, SeaMonkey) and Ch...

[SECURITY] [DLA 62-1] nss security update

Package : nss Version : 3.12.8-1+squeeze9 CVE ID : CVE-2014-1568 Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craf...

Mozilla Patches RSA Signature Forgery in NSS, Firefox

The Mozilla Foundation has issued a security alert informing users that they have updated a number of their products in order to fix a vulnerability that could allow an attacker to forge RSA certificate signatures and perform man-in-the-middle attacks. The vulnerability has been known for some...

[SECURITY] [DSA 3034-1] iceweasel security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3034-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez September 25, 2014 http://www.debian.org/security/faq -...

[SECURITY] [DSA 3033-1] nss security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3033-1 [email protected] http://www.debian.org/security/ Yves-Alexis Perez September 25, 2014 http://www.debian.org/security/faq -...

Google Chrome < 37.0.2062.124 Multiple Vulnerabilities (Mac OS X)

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 37.0.2062.124. It is, therefore, affected by an issue in the Network Security Services NSS libraries. This issue is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forgery...

SOL15630 - TLS in Mozilla NSS vulnerability CVE-2013-1620

Vulnerability Recommended Actions If the previous table lists a version in the Versions known to be not vulnerable column, you can eliminate this vulnerability by upgrading to the listed version. If the table does not list any version in the column, then no upgrade candidate currently exists...

DSA-3034-1 iceweasel - security update

Bulletin has no description...

CVE-2014-1568: Undefined Security Weakness

Mozilla Network Security Services NSS before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1...

Ubuntu: Security Advisory (USN-2361-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...