1833 matches found
CVE-2015-7575
Mozilla Network Security Services NSS before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof...
CVE-2015-7575
Mozilla Network Security Services NSS before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof...
CVE-2015-7575
Mozilla Network Security Services NSS before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof...
CVE-2015-7575
Mozilla Network Security Services NSS before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof...
USN-2866-1 firefox vulnerability
Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...
[SECURITY] Fedora 23 Update: mod_nss-1.0.12-1.fc23
The modnss module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL and Transport Layer Security TLS protocols using the Network Security Services NSS security library...
nss security update
CentOS Errata and Security Advisory CESA-2016:0007 Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, whi...
USN-2864-1 nss vulnerability
Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...
Moderate: Red Hat Security Advisory: nss security update
Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...
Hackers Cause World's First Power Outage with Malware
SCADA system has always been an interesting target for cyber crooks, given the success of Stuxnet malware that was developed by the US and Israeli together to sabotage the Iranian nuclear facilities a few years ago, and "Havex" that previously targeted organizations in the energy sector. Now once...
Multiple Mozilla Products Security Bypass Vulnerabilities
Mozilla Firefox, Firefox ESR, and Network Security Services are all developed by the Mozilla Foundation in the U.S. Firefox is an open-source web browser; Firefox ESR is an extended support version of Firefox.Network Security Services NSS is a library of functions Network Security Services librar...
FreeBSD : NSS -- MD5 downgrade in TLS 1.2 signatures (10f7bc76-0335-4a88-b391-0b05b3a8ce1c) (SLOTH)
The Mozilla Project reports : Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services NSS where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the accepti...
NSS -- MD5 downgrade in TLS 1.2 signatures
The Mozilla Project reports: Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services NSS where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the acceptin...
PT-2015-2971
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 43.0.2 Mozilla Firefox ESR versions prior to 38.5.2 Mozilla Network Security Services NSS versions prior to 3.20.2 Oracle Java SE affected versions not specified Description The issue is related to errors in t...
MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature — Mozilla
Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services NSS where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the accepting MD5 as a hash algorithm in...
The vulnerability of Firefox and Firefox ESR browsers allows a perpetrator to trigger a service failure or execute arbitrary code.
The vulnerability of Mozilla Network Security Services for Firefox and Firefox ESR browsers is caused by a buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code using specially crafted OCTET STRING data...
Vulnerability of Firefox and Firefox ESR browsers, allowing attackers to execute arbitrary code or trigger service denial-of-service attacks
The vulnerability of the PLARENAALLOCATE implementation in Mozilla Network Security Services for Firefox and Firefox ESR browsers is related to a buffer overflow caused by a numerical overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure...
sssd: memory leak in the sssd_pac_plugin
It was found that SSSD's Privilege Attribute Certificate PAC responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon...
nss: use-after-poison in sec_asn1d_parse_leaf() (MFSA 2015-133)
A use-after-poison flaw was found in the way NSS parsed certain ASN.1 structures. An attacker could use this flaw to cause NSS to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSS library...