Mozilla Network Security Service (NSS): Multiple vulnerabilities

Background The Mozilla Network Security Service NSS is a library implementing security features like SSL v.2/v.3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME and X.509 certificates. Description Multiple vulnerabilities have been discovered in NSS. Please review the CVE identifiers referenced...

The vulnerability of the modular inversion function of the NSS libraries allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the modular inversion function in Network Security Services libraries is related to the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

Researchers Warn of Active Malware Campaign Using HTML Smuggling

An active campaign has been spotted that utilizes HTML smuggling to deliver malware, effectively bypassing various network security solutions, including sandboxes, legacy proxies and firewalls. Krishnan Subramanian, security researcher with Menlo Security, told Threatpost that the campaign...

net-snmp before 5.8.1.pre1 has a double free in usm_free_usmStateReference in snmplib/snmpusm.c via an SNMPv3 GetBulk request. NOTE: this affects net-snmp packages shipped to end users by multiple Linux distributions but might not affect an upstream release.

...

UBUNTU-CVE-2020-12403

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 which was not functioning correctly and strictly enforcing tag length...

Debian DLA-2330-1 : jruby security update

Several vulnerabilities were fixed in JRuby, a 100% pure-Java implementation of Ruby. CVE-2017-17742 CVE-2019-16254 HTTP Response Splitting attacks in the HTTP server of WEBrick. CVE-2019-16201 Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication...

Debian DLA-2332-2 : sane-backends regression update

A regression was introduced in DLA-2332-1, where changes in the Debian package building process triggered a bug in the sane-backends packages, causing missing files. For Debian 9 stretch, this problem has been fixed in version 1.0.25-4.1+deb9u2. We recommend that you upgrade your sane-backends...

[SECURITY] Fedora 32 Update: nss-3.55.0-1.fc32

Network Security Services NSS is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS 5, PKCS 7, PKCS 11, PKCS 12, S/MIME, X.509 v3 certificates, and other security...

CVE-2020-17475

CVE-2020-17475 affects MEGVII Koala 2.9.1-c3s. The issue is a lack of authentication in the network relays, enabling an attacker to grant physical access by sending packet data to UDP port 5000. The vulnerability is documented in multiple feeds (NVD entry and CNVD-2020-49540) with an attack surfa...

Fedora 32 : hylafax+ (2020-01eb48bcce)

update to 7.0.3 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security, Inc. T...

Debian DLA-2324-1 : linux-latest-4.19 new package

Linux 4.19 has been packaged for Debian 9 as linux-4.19. This provides a supported upgrade path for systems that currently use kernel packages from the 'stretch-backports' suite. However, 'apt full-upgrade' will not automatically install the updated kernel packages. You should explicitly install...

CVE-2020-2035

CVE-2020-2035 (PAN-OS) affects PAN-OS when SSL/TLS Forward Proxy Decryption is enabled. The URL filtering policy inspects HTTP Host/URL path but ignores the TLS Client Hello SNI, allowing a compromised host to evade policies on decrypted HTTPS traffic. Impact is described as low for integrity; no...

Fedora 31 : virtualbox-guest-additions (2020-dbf6c6f22f)

New upstream release Overview of fixed security issues: https://www.oracle.com/security-alerts/cpujul2020.htmlAppendixOVIR Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean...

Fedora 31 : python36 (2020-efb908b6a8)

Security fix for CVE-2019-20907, CVE-2020-14422. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C...

Fedora 32 : kernel (2020-8d634e31c0)

The 5.7.14 stable kernel update contains a number of important fixes across the tree. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

SUSE SLED15 / SLES15 Security Update : libX11 (SUSE-SU-2020:2197-1)

This update for libX11 fixes the following issues : Fixed XIM client heap overflows CVE-2020-14344, bsc1174628. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as...

Top Tips For Home Cybersecurity And Privacy In A Coronavirus-Impacted World (Part 2)

The past few months have seen radical changes to our work and home life under the Coronavirus threat, upending norms and confining millions of American families within just four walls. In this context, it’s not surprising that more of us are spending an increasing portion of our lives online. But...

August 11, 2020—KB4571746 (Security-only update)

None None...

USN-4455-1 nss vulnerabilities

It was discovered that NSS incorrectly handled certain signatures. An attacker could possibly use this issue to expose sensitive information. CVE-2020-12400, CVE-2020-12401, CVE-2020-6829...

Continuous Monitoring and Beyond

As security professionals, we struggle with the high volume of data we need to sort through while trying to parse out the critical alerts that are important for us to take immediate action upon. Being at the forefront of innovation for the past 20 years, Qualys offers 20 plus solutions which all...