glibc: arbitrary code execution

A buffer overflow in gethostbynamer and related functions performing DNS requests has been fixed. If the NSS functions were called with a misaligned buffer, the buffer length change due to pointer alignment was not taken into account. This could result in application crashes or potentially...

Oracle iPlanet Web Proxy Server 4.0 < 4.0.25 NSS Signature Verification Vulnerability

According to its self-reported version, the Oracle iPlanet Web Proxy Server installed on the remote host is version 4.0 prior to 4.0.25. It is, therefore, affected by a flaw in the Network Security Services NSS library due to improper parsing of ASN.1 values in an RSA signature. A man-in-the-midd...

Oracle iPlanet Web Server 7.0.x < 7.0.21 NSS Signature Verification Vulnerability

According to its self-reported version, the Oracle iPlanet Web Server formerly known as Sun Java System Web Server running on the remote host is 7.0.x prior to 7.0.21. It is, therefore, affected by a flaw in the Network Security Services NSS library due to improper parsing of ASN.1 values in an R...

Oracle GlassFish Server Multiple Vulnerabilities (April 2015 CPU) (POODLE)

The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities : - A flaw exists in the bundled cURL and libcurl packages. The certificate CN and SAN name field verification CURLOPTSSLVERIFYHOST is disabled when the digital signature verification...

Fedora 21 : ca-certificates-2015.2.3-1.0.fc21 (2015-4711)

This is an update to the set of CA certificates released with NSS version 3.18 However, the package modifies the CA list to keep several legacy CAs still trusted for compatibility reasons. Please refer to the project URL for details. If you prefer to use the unchanged list provided by Mozilla, an...

Fedora 20 : ca-certificates-2015.2.3-1.0.fc20 (2015-4486)

This is an update to the set of CA certificates released with NSS version 3.18 However, the package modifies the CA list to keep several legacy CAs still trusted for compatibility reasons. Please refer to the project URL for details. If you prefer to use the unchanged list provided by Mozilla, an...

Fedora 22 : ca-certificates-2015.2.3-1.0.fc22 (2015-4722)

This is an update to the set of CA certificates released with NSS version 3.18 However, the package modifies the CA list to keep several legacy CAs still trusted for compatibility reasons. Please refer to the project URL for details. If you prefer to use the unchanged list provided by Mozilla, an...

Design/Logic Flaw

DBLOOKUP in nssfiles/files-XXX.c in the Name Service Switch NSS in GNU C Library aka glibc or libc6 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service infinite loop by performing a look-up on a database while iterating over it,...

CVE-2014-8121

CVE-2014-8121 affects the GNU C Library (glibc/eglibc) NSS backend: DB_LOOKUP in nss_files/files-XXX.c can loop indefinitely when a file is being iterated, by not properly checking if the database file is open. This can lead to a denial of service. The affected line of code is in the NSS file bac...

Debian DLA-62-1 : nss security update

Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS the Mozilla Network Security Service library was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. An attacker could craft ASN.1 data to forge RSA certificates with a valid certification...

Scientific Linux Security Update : 389-ds-base on SL7.x x86_64 (20150305)

An information disclosure flaw was found in the way the 389 Directory Server stored information in the Changelog that is exposed via the 'cn=changelog' LDAP sub-tree. An unauthenticated user could in certain cases use this flaw to read data from the Changelog, which could include sensitive...

Debian DLA-23-1 : nss security update

CVE-2013-1741 Runaway memset in certificate parsing on 64-bit computers leading to a crash by attempting to write 4Gb of nulls. CVE-2013-5606 Certificate validation with the verifylog mode did not return validation errors, but instead expected applications to determine the status by looking at th...

Debian DLA-89-1 : nss security update

In nss, a set of libraries designed to support cross-platform development of security-enabled client and server applications, Tyson Smith and Jesse Schwartzentruber discovered a use-after-free vulnerability that allows remote attackers to execute arbitrary code by triggering the improper removal ...

Debian DLA-154-1 : nss security update (BEAST)

nss 3.12.8-1+squeeze11 fixes two security issues : CVE-2011-3389 SSL 3.0 and TLS 1.0 connections were vulnerable to some chosen plaintext attacks which allowed man-in-the middle attackers to obtain plaintext HTTP headers on an HTTPS session. This issue is known as the 'BEAST' attack. CVE-2014-156...

Amazon Linux AMI : glibc (ALAS-2015-495)

An out-of-bounds read flaw was found in the way glibc's iconv function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv function with a specially crafted argument could use this flaw to crash that application. CVE-2014-6040 It was found that the file...

CA Tied to Chinese Registrar Issued Unauthorized Google Certificates

Google security engineers, investigating fraudulent certificates issued for several of the company’s domains, discovered that a Chinese certificate authority was using an intermediate CA, MCS Holdings, that issued the unauthorized Google certificates, and could have issued certificates for...

Medium: glibc

Issue Overview: An out-of-bounds read flaw was found in the way glibc's iconv function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv function with a specially crafted argument could use this flaw to crash that application. CVE-2014-6040 It was fou...

Mandriva Linux Security Advisory : nss (MDVSA-2015:059)

Multiple vulnerabilities has been found and corrected in the Mozilla NSS and NSPR packages : The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an...

CentOS 7 : glibc (CESA-2015:0327)

Updated glibc packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Debian DSA-3186-1 : nss - security update

It was discovered that the Mozilla Network Security Service library nss incorrectly handled certain ASN.1 lengths. A remote attacker could possibly use this issue to perform a data-smuggling attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in th...