Privacy-focused Tails 1.1.2 Operating System Released

Tails, a Linux-based highly secure Operating System specially designed and optimized to preserve users' anonymity and privacy, has launched its new release, Tails version 1.1.2. Tails, also known as 'Amnesiac Incognito Live System', is a free security-focused Debian-based Linux distribution, whic...

[SECURITY] Fedora 20 Update: nss-softokn-3.17.1-2.fc20

Network Security Services Softoken Cryptographic Module...

[SECURITY] Fedora 20 Update: nss-util-3.17.1-1.fc20

Utilities for Network Security Services and the Softoken module...

nss: RSA PKCS#1 signature verification forgery flaw (MFSA 2014-73)

A flaw was found in the way NSS parsed ASN.1 Abstract Syntax Notation One input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS...

Firefox < 32.0.3 NSS Signature Verification Vulnerability (Mac OS X)

The version of Firefox installed on the remote host is prior to 32.0.3. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL certificate...

Mozilla Thunderbird < 31.1.2 NSS Signature Verification Vulnerability

The version of Thunderbird installed on the remote host is prior to 31.1.2. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Firefox ESR 24.x < 24.8.1 NSS Signature Verification Vulnerability (Mac OS X)

The version of Firefox ESR 24.x installed on the remote host is prior to 24.8.1. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Firefox ESR 31.x < 31.1.1 NSS Signature Verification Vulnerability

The version of Firefox ESR 31.x installed on the remote host is prior to 31.1.1. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Firefox ESR 31.x < 31.1.1 NSS Signature Verification Vulnerability (Mac OS X)

The version of Firefox ESR 31.x installed on the remote host is prior to 31.1.1. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Mozilla Thunderbird 24.x < 24.8.1 NSS Signature Verification Vulnerability (Mac OS X)

The version of Thunderbird 24.x installed on the remote host is prior to 24.8.1. It is, therefore, affected by a flaw in the Network Security Services NSS library, which is due to lenient parsing of ASN.1 values involved in a signature and can lead to the forgery of RSA signatures, such as SSL...

Design/Logic Flaw

Mozilla Network Security Services NSS before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1...

CVE-2014-1568

Mozilla Network Security Services NSS before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1...

Mozilla Patches RSA Signature Forgery in NSS, Firefox

The Mozilla Foundation has issued a security alert informing users that they have updated a number of their products in order to fix a vulnerability that could allow an attacker to forge RSA certificate signatures and perform man-in-the-middle attacks. The vulnerability has been known for some...

USN-2360-2 thunderbird vulnerabilities

USN-2360-1 fixed vulnerabilities in Firefox. This update provides the corresponding updates for Thunderbird. Original advisory details: Antoine Delignat-Lavaud and others discovered that NSS incorrectly handled parsing ASN.1 values. An attacker could use this issue to forge RSA certificates...

USN-2361-1 nss vulnerability

Antoine Delignat-Lavaud and others discovered that NSS incorrectly handled parsing ASN.1 values. An attacker could use this issue to forge RSA certificates...

RSA Signature Forgery in NSS — Mozilla

Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services NSS libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is...

NSS: Signature forgery attack

Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services NSS libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is...

UBUNTU-CVE-2014-1568

Mozilla Network Security Services NSS before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1...

PT-2014-1379

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services NSS versions prior to 3.16.2.1 Mozilla Firefox versions prior to 32.0.3 Mozilla Firefox ESR versions prior to 24.8.1 and 31.x prior to 31.1.1 Mozilla Thunderbird versions prior to 24.8.1 and 31.x prior to 31.1...

nss: TOCTOU, potential use-after-free in libssl's session ticket processing (MFSA 2014-12)

A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application...