Design/Logic Flaw

Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger...

Critical: nss

Issue Overview: Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors...

nss: false start PR_Recv information disclosure security issue

A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server...

nss: Race-condition in certificate verification can lead to Remote code execution (MFSA 2014-63)

A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application...

UBUNTU-CVE-2014-1544

Use-after-free vulnerability in the CERTDestroyCertificate function in libnss3.so in Mozilla Network Security Services NSS 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger...

Oracle iPlanet Web Server 7.0.x < 7.0.20 Multiple Vulnerabilities

According to its self-reported version, the Oracle iPlanet Web Server formerly Sun Java System Web Server running on the remote host is 7.0.x prior to 7.0.20. It is, therefore, affected by the following vulnerabilities in the Network Security Services NSS : - The implementation of NSS does not...

Oracle GlassFish Server Multiple Vulnerabilities (July 2014 CPU)

The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities in the following components : - The implementation of Network Security Services NSS does not ensure that data structures are initialized, which could result in a denial of service or disclosure of...

CVE-2014-0249

The System Security Services Daemon SSSD 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors...

CVE-2014-0249

The System Security Services Daemon SSSD 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors...

Design/Logic Flaw

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

Mozilla Network Security Services 'p12creat.c'内存破坏漏洞

Bugtraq ID:66366 CVE ID:CVE-2014-1492 NSS实现SSL v2/v3, TLS, PKCS5, PKCS7, PKCS11, PKCS12, S/MIME, X.509v3证书和其他安全标准。 Network Security Services "secpkcs12newasafe"函数security/nss/lib/pkcs12/p12creat.c存在错误，允许攻击者利用漏洞破坏内存，使应用程序崩溃或执行任意代码。 0 Network Security Services NSS 3.x Network Security Services...

UBUNTU-CVE-2014-1492

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

CVE-2014-1492

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

Cisco IPS Software Control-Plane MainApp拒绝服务漏洞

Bugtraq ID:65667 CVE ID:CVE-2014-0719 Cisco IPS Software是一款思科开发的入侵防御系统。 Cisco IPS Software上的Control-plane访问列表实现中存在漏洞，允许未验证远程攻击者使MainApp进程变得不稳定。 漏洞是由于不正确处理发送给受影响系统的管理IP地址的畸形TCP报文，向TCP 7000端口发送特制报文可使MainApp进程变得不稳定。 0 Cisco ASA 5505 Advanced Inspection and Prevention Security Services Card AIP SSC...

Mozilla Network Security Services释放后重利用内存破坏漏洞(CVE-2014-1490)

BUGTRAQ ID: 65335 CVECAN ID: CVE-2014-1490 Mozilla Network Security Services是一组库，用于支持跨平台开发安全的客户端和服务器应用。 Mozilla Network Security Services 3.15.4之前版本中，libssl存在竞争条件，可使远程攻击者用恢复握手触发会话票据错误重置，导致拒绝服务。 0 Mozilla Network Security Services = 3.15.4 厂商补丁： Mozilla -------...

CVE-2014-1491

Mozilla Network Security Services NSS before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote...

DEBIAN-CVE-2014-1490

Race condition in libssl in Mozilla Network Security Services NSS before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service use-after-free or possibl...

CVE-2014-1491

Mozilla Network Security Services NSS before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote...

CVE-2014-1490

Race condition in libssl in Mozilla Network Security Services NSS before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service use-after-free or possibl...

Authentication flaw

Mozilla Network Security Services NSS before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote...