USN-2866-1 firefox vulnerability

Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...

[SECURITY] Fedora 23 Update: mod_nss-1.0.12-1.fc23

The modnss module provides strong cryptography for the Apache Web server via the Secure Sockets Layer SSL and Transport Layer Security TLS protocols using the Network Security Services NSS security library...

nss security update

CentOS Errata and Security Advisory CESA-2016:0007 Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, whi...

USN-2864-1 nss vulnerability

Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information...

Moderate: Red Hat Security Advisory: nss security update

Updated nss packages that fix one security issue are now available for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Hackers Cause World's First Power Outage with Malware

SCADA system has always been an interesting target for cyber crooks, given the success of Stuxnet malware that was developed by the US and Israeli together to sabotage the Iranian nuclear facilities a few years ago, and "Havex" that previously targeted organizations in the energy sector. Now once...

Multiple Mozilla Products Security Bypass Vulnerabilities

Mozilla Firefox, Firefox ESR, and Network Security Services are all developed by the Mozilla Foundation in the U.S. Firefox is an open-source web browser; Firefox ESR is an extended support version of Firefox.Network Security Services NSS is a library of functions Network Security Services librar...

FreeBSD : NSS -- MD5 downgrade in TLS 1.2 signatures (10f7bc76-0335-4a88-b391-0b05b3a8ce1c) (SLOTH)

The Mozilla Project reports : Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services NSS where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the accepti...

MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature — Mozilla

Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services NSS where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the accepting MD5 as a hash algorithm in...

NSS -- MD5 downgrade in TLS 1.2 signatures

The Mozilla Project reports: Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services NSS where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the acceptin...

The vulnerability of Firefox and Firefox ESR browsers allows a perpetrator to trigger a service failure or execute arbitrary code.

The vulnerability of Mozilla Network Security Services for Firefox and Firefox ESR browsers is caused by a buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code using specially crafted OCTET STRING data...

Vulnerability of Firefox and Firefox ESR browsers, allowing attackers to execute arbitrary code or trigger service denial-of-service attacks

The vulnerability of the PLARENAALLOCATE implementation in Mozilla Network Security Services for Firefox and Firefox ESR browsers is related to a buffer overflow caused by a numerical overflow. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure...

sssd: memory leak in the sssd_pac_plugin

It was found that SSSD's Privilege Attribute Certificate PAC responder plug-in would leak a small amount of memory on each authentication request. A remote attacker could potentially use this flaw to exhaust all available memory on the system by making repeated requests to a Kerberized daemon...

nss: use-after-poison in sec_asn1d_parse_leaf() (MFSA 2015-133)

A use-after-poison flaw was found in the way NSS parsed certain ASN.1 structures. An attacker could use this flaw to cause NSS to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSS library...

[SECURITY] Fedora 21 Update: nss-softokn-3.20.1-1.0.fc21

Network Security Services Softoken Cryptographic Module...

Mozilla NSS/Firefox Integer Overflow Vulnerability

Mozilla Firefox is an open source web browser that uses the Gecko engine. Network Security Services NSS is a set of libraries for cross-platform development of security-enabled client and server applications. Applications compiled with NSS can support security standards such as SSLv2, SSLv3, TLS,...

Mozilla Firefox and Firefox ESR Network Security Services Buffer Overflow Vulnerability

Mozilla Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox.Mozilla Network Security Services NSS is a library of network security services. The 'secasn1dparseleaf' function in Mozilla NSS, used in Mozilla Firefox and Firefox ESR, fails to properly restric...

Mozilla Firefox and Firefox ESR Network Security Services Heap Buffer Overflow Vulnerability

Mozilla Firefox is an open source web browser; Firefox ESR is an extended support version of Firefox.Mozilla Network Security Services NSS is a library of network security services. A buffer overflow vulnerability in the ASN.1 decoder used in Mozilla Firefox and Firefox ESR could allow an attacke...

CVE-2015-7183

Integer overflow in the PLARENAALLOCATE implementation in Netscape Portable Runtime NSPR in Mozilla Network Security Services NSS before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute...

DEBIAN-CVE-2015-7183

Integer overflow in the PLARENAALLOCATE implementation in Netscape Portable Runtime NSPR in Mozilla Network Security Services NSS before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firefox ESR 38.x before 38.4 and other products, allows remote attackers to execute...