Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass

source: https://www.securityfocus.com/bid/35888/info Mozilla Network Security Services NSS is prone to a security-bypass vulnerability because it fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. Th...

Cross site request forgery (csrf)

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

DEBIAN-CVE-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

CVE-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

CVE-2009-3555

CVE-2009-3555 concerns a TLS/SSL renegotiation flaw where renegotiation handshakes were not properly associated with the existing connection, enabling MITM data insertion in HTTPS and other TLS/SSL sessions (Project Mogul). Connected advisories show concrete mitigations and affected software: Pou...

deprecate MD2 in SSL cert validation (Kaminsky)

The Network Security Services NSS library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash...

CVE-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services IIS 7.0, modssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services NSS 3.12.4 and earlier, multiple Cis...

SLES10: Security update for Mozilla NSS

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: mozilla-nspr mozilla-nspr-devel mozilla-nss mozilla-nss-devel More details may also be found by searching for the SuSE Enterprise Server 10 patch database...

SLES10: Security update for Mozilla NSS

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: mozilla-nspr mozilla-nspr-devel mozilla-nss mozilla-nss-devel More details may also be found by searching for the SuSE Enterprise Server 10 patch database...

SuSE 10 Security Update : Mozilla NSS (ZYPP Patch Number 6541)

The Mozilla NSS security framework was updated to version 3.12.3.1. - Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger AIM, allows remote SSL...

SLES11: Security update for Firefox

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: MozillaFirefox MozillaFirefox-branding-SLED MozillaFirefox-translations libfreebl3 mozilla-nspr mozilla-nss mozilla-nss-tools mozilla-xulrunner191...

SLES11: Security update for Firefox

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: MozillaFirefox MozillaFirefox-branding-SLED MozillaFirefox-translations libfreebl3 mozilla-nspr mozilla-nss mozilla-nss-tools mozilla-xulrunner191...

SLES11: Security update for Mozilla Firefox

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: libfreebl3 mozilla-nss mozilla-nss-tools More details may also be found by searching for the SuSE Enterprise Server 11 patch database linked in the reference...

openSUSE 10 Security Update : libfreebl3 (libfreebl3-6494)

The Mozilla NSS and dependend libraries were updated to fix various issues. CVE-2009-2404 / MFSA 2009-43 : Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Insta...

Mandrake Security Advisory MDVSA-2009:237 (openssl)

The remote host is missing an update to openssl announced via advisory MDVSA-2009:237. OpenVAS Vulnerability Test $Id: mdksa2009237.nasl 6587 2017-07-07 06:35:35Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:237 openssl Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Mandrake Security Advisory MDVSA-2009:239 (openssl)

The remote host is missing an update to openssl announced via advisory MDVSA-2009:239. OpenVAS Vulnerability Test $Id: mdksa2009239.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:239 openssl Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Microsoft Says Google Chrome Frame is IE Security Risk

Google’s decision to introduce a plug-in that runs Google Chrome inside Microsoft’s Internet Explorer isn’t sitting well with the folks at Redmond. The Google Chrome Frame, which is presented as a seamless way to bring Google Chrome’s open web technologies and speedy JavaScript engine to Internet...

SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1199)

The Mozilla NSS security framework was updated to version 3.12.3.1. - Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger AIM, allows remote SSL...

Mandriva Linux Security Advisory : openssl (MDVSA-2009:238)

Multiple vulnerabilities was discovered and corrected in openssl : Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impa...

CentOS Security Advisory CESA-2009:1428 (xmlsec1)

The remote host is missing updates to xmlsec1 announced in advisory CESA-2009:1428. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...