UBUNTU-CVE-2015-7183

Integer overflow in the PLARENAALLOCATE implementation in Netscape Portable Runtime NSPR in Mozilla Network Security Services NSS before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute...

UBUNTU-CVE-2015-7181

The secasn1dparseleaf function in Mozilla Network Security Services NSS before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, improperly restricts access to an unspecified data structure, which allows remote attackers to caus...

PT-2015-6117 · Libreswan +4 · Libreswan +4

Name of the Vulnerable Software and Affected Versions: libreswan versions prior to 3.15 Openswan versions prior to 2.6.45 Description: The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and daemon restart. This occurs when a zero DH g^x value is...

NSS and NSPR memory corruption issues — Mozilla

Mozilla engineers Tyson Smith and David Keeler reported a use-after-poison and buffer overflow in the ASN.1 decoder in Network Security Services NSS. These issues were in octet string parsing and were found through fuzzing and code inspection. If these issues were triggered, they would lead to a...

UBUNTU-CVE-2015-5292

Memory leak in the Privilege Attribute Certificate PAC responder plugin sssdpacplugin.so in System Security Services Daemon SSSD 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service memory consumption via a large number of logins that trigger parsing of PAC blobs duri...

CentOS 6 / 7 : nss-softokn (CESA-2015:1699)

Updated nss-softokn packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

SUSE: Security Advisory for mozilla-nss (SUSE-SU-2014:1220-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mozilla Network Security Services 'SSL_ImplementedCiphers' Security Bypass Vulnerability

Mozilla Network Security Services is a library that provides cross-platform support for SSL, S/MIME and other Internet security standards. A security bypass vulnerability exists in Mozilla Network Security Services, which could be exploited by a remote attacker to perform a man-in-the-middle atta...

Amazon Linux: Security Advisory (ALAS-2014-385)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Update for nss-softokn RHSA-2015:1699-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS Update for nss-softokn CESA-2015:1699 centos7

Check the version of nss-softokn SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.882271";...

nss security update

CentOS Errata and Security Advisory CESA-2015:1699 Updated nss-softokn packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...

NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)

A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks...

NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)

A flaw was found in the way NSS verified certain ECDSA Elliptic Curve Digital Signature Algorithm signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks...

NSS: incorrectly permited skipping of ServerKeyExchange (MFSA 2015-71)

It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE Elliptic Curve Diffie-Hellman key Exchange. A remote attacker could use this flaw to bypass the forward-secrecy of a TLS/SSL connection...

Cisco Unified Communications Manager - Multiple Vulnerabilities

Cisco Unified Communications Manager - Multiple Vulnerabilities Vantage Point Security Advisory 2015-001 ======================================== Title: Cisco Unified Communications Manager Multiple Vulnerabilities Vendor: Cisco Vendor URL: http://www.cisco.com/ Versions affected: Summary: ------...

Oracle iPlanet Web Proxy Server 4.0.x < 4.0.26 NSS Signature Handling Remote Code Injection

According to its self-reported version, the Oracle iPlanet Web Proxy Server formerly known as Sun Java System Web Proxy Server installed on the remote host is version 4.0.x prior to 4.0.26. It is, therefore, affected by a flaw in the definitelengthdecoder function in the Network Security Services...

USN-2673-1 thunderbird vulnerabilities

Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove the forward-secrecy property...

Mozilla Network Security Services Encryption Issue Vulnerability

Mozilla Firefox, Firefox ESR, and Thunderbird are all developed by the Mozilla Foundation in the U.S. Firefox is an open-source web browser; Firefox ESR is an extended support version of Firefox; and Thunderbird is a separate email client from the Mozilla Application Suite. Thunderbird is a...

Firefox ESR < 38.1 Multiple Vulnerabilities (Logjam)

The version of Firefox ESR installed on the remote Windows host is prior to 38.1. It is, therefore, affected by multiple vulnerabilities : - A security downgrade vulnerability exists due to a flaw in Network Security Services NSS. When a client allows for a ECDHEECDSA exchange, but the server doe...