SUSE SLED15 / SLES15 Security Update : MozillaFirefox (SUSE-SU-2019:0273-1)

This update for MozillaFirefox, mozilla-nss fixes the following issues : Security issues fixed : CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream bsc1122983. CVE-2018-18501: Fixed multiple memory safety bugs bsc1122983. CVE-2018-18505: Fixed a privilege escalation through IPC channel...

openSUSE Security Update : MozillaFirefox (openSUSE-2019-133)

This update for MozillaFirefox, mozilla-nss fixes the following issues: Security issues fixed : - CVE-2018-18500: Fixed a use-after-free parsing HTML5 stream boo1122983. - CVE-2018-18505: Fixed a privilege escalation through IPC channel messages boo1122983. - CVE-2018-18501: Fixed multiple memory...

The vulnerability of the PAM module for handling NSS data for the LDAP server nss-pam-ldapd allows a perpetrator to bypass the authentication process.

The vulnerability of the PAM module “nslcd/pam.c” for handling NSS data for the LDAP server nss-pam-ldapd is related to the return of the success code when the user is not found in the LDAP database. Exploiting this vulnerability can allow a malicious actor to bypass the authentication process...

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2019:0133-1)

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for MozillaFirefox (important)

openSUSE Security Update: Security update for MozillaFirefox Announcement ID: openSUSE-SU-2019:0133-1 Rating: important References: 1121255 1122983 Cross-References: CVE-2018-18500 CVE-2018-18501 CVE-2018-18505 Affected Products: openSUSE Leap 42.3 An update that fixes three vulnerabilities is no...

MGASA-2019-0038 Updated nss packages fix security vulnerability

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys CVE-2018-0495...

Updated nss packages fix security vulnerability

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation. A local attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys CVE-2018-0495...

Man-in-the-Middle (MitM)

nss is vulnerable to man-in-the-middle attack. ServerHello.random is all zeros when handling a v2-compatible ClientHello, which would allow an attacker to perform man-in-the-middle attack to perform a passive replay attack...

Denial Of Service (DoS)

nss is vulnerable to denial of service. A use-after-free flaw was found in the TLS 1.2 implementation in the NSS library when client authentication was used. A malicious client could use this flaw to cause an application compiled against NSS to crash or, potentially, execute arbitrary code with t...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as a null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as Mozilla Network Security Services NSS before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service out-of-bounds write or...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as a use-after-free vulnerability in the ssl3HandleECDHServerKeyExchange function in Mozilla Network Security Services NSS before 3.21, as used in Mozilla Firefox before 44.0, allows remote attackers to cause a denial of...

Arbitrary Code Execution

nss-util is vulnerable to arbitrary code execution. A heap-based buffer overflow flaw was found in the way NSS parsed certain ASN.1 structures. An attacker could use this flaw to create a specially crafted certificate which, when parsed by NSS, could cause it to crash, or execute arbitrary code,...

Man-in-the-Middle (MitM)

nss is vulnerable to man-in-the-middle attack. A flaw was found in the way TLS 1.2 could use the MD5 hash function for signing ServerKeyExchange and Client Authentication packets during a TLS handshake. A man-in-the-middle attacker able to force a TLS connection to use the MD5 hash function could...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as the secasn1dparseleaf function in Mozilla Network Security Services NSS before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restrict...

Spoofable ECDSA Signatures

nss-softokn is vulnerable to spoofable ECDSA signatures. The vulnerability exists as Mozilla Network Security Services NSS before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve...

HTTP Request Smuggling

nspr is vulnerable to HTTP request smuggling attacks. The vulnerability exists as the definitelengthdecoder function in lib/util/quickder.c in Mozilla Network Security Services NSS before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed...

Spoofable RSA Signatures

nss is vulnerable to spoofable RSA signature attacks. The vulnerability exists as Mozilla Network Security Services NSS before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla...

Denial Of Service (DoS)

nss is vulnerable to denial of service DoS attacks. The vulnerability exists as the CERTDecodeCertPackage function in Mozilla Network Security Services NSS, as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5,...

Man-in-the-Middle (MitM) Attacks

nss is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as the sslDo1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services NSS before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by...