Executive Summary

Summary
Title iceweasel security update
Informations
Name DSA-2955 First vendor Publication 2014-06-11
Vendor Debian Last vendor Modification 2014-06-11
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service.

For the stable distribution (wheezy), these problems have been fixed in version 24.6.0esr-1~deb7u1.

For the unstable distribution (sid), these problems have been fixed in version 30.0-1.

We recommend that you upgrade your iceweasel packages.

Original Source

Url : http://www.debian.org/security/2014/dsa-2955

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:24262
 
Oval ID: oval:org.mitre.oval:def:24262
Title: RHSA-2014:0741: firefox security update (Critical)
Description: Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1533, CVE-2014-1538, CVE-2014-1541) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Christoph Diehl, Christian Holler, Hannes Verschore, Jan de Mooij, Ryan VanderMeulen, Jeff Walden, Kyle Huey, Abhishek Arya, and Nils as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.6.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 24.6.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
Family: unix Class: patch
Reference(s): RHSA-2014:0741-00
CESA-2014:0741
CVE-2014-1533
CVE-2014-1538
CVE-2014-1541
 Version: 4
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
CentOS Linux 5
CentOS Linux 6
CentOS Linux 7
 Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24267
 
Oval ID: oval:org.mitre.oval:def:24267
Title: Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Description: Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2014-1538
 Version: 10
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
 Product(s): Mozilla Firefox
Mozilla Firefox ESR
Mozilla Thunderbird
Mozilla Seamonkey
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24300
 
Oval ID: oval:org.mitre.oval:def:24300
Title: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Family: windows Class: vulnerability
Reference(s): CVE-2014-1533
 Version: 10
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
 Product(s): Mozilla Firefox
Mozilla Firefox ESR
Mozilla Thunderbird
Mozilla Seamonkey
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24670
 
Oval ID: oval:org.mitre.oval:def:24670
Title: RHSA-2014:0742: thunderbird security update (Important)
Description: Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1533, CVE-2014-1538, CVE-2014-1541) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Christoph Diehl, Christian Holler, Hannes Verschore, Jan de Mooij, Ryan VanderMeulen, Jeff Walden, Kyle Huey, Abhishek Arya, and Nils as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.6.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.6.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
Family: unix Class: patch
Reference(s): RHSA-2014:0742-00
CESA-2014:0742
CVE-2014-1533
CVE-2014-1538
CVE-2014-1541
 Version: 3
Platform(s): Red Hat Enterprise Linux 5
Red Hat Enterprise Linux 6
CentOS Linux 5
CentOS Linux 6
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24886
 
Oval ID: oval:org.mitre.oval:def:24886
Title: Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
Description: Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.
Family: windows Class: vulnerability
Reference(s): CVE-2014-1541
 Version: 10
Platform(s): Microsoft Windows 2000
Microsoft Windows XP
Microsoft Windows Server 2003
Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
 Product(s): Mozilla Firefox
Mozilla Firefox ESR
Mozilla Thunderbird
Mozilla Seamonkey
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24891
 
Oval ID: oval:org.mitre.oval:def:24891
Title: DSA-2960-1 icedove - security update
Description: Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service.
Family: unix Class: patch
Reference(s): DSA-2960-1
CVE-2014-1533
CVE-2014-1538
CVE-2014-1541
CVE-2014-1545
 Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
 Product(s): icedove
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24988
 
Oval ID: oval:org.mitre.oval:def:24988
Title: DSA-2962-1 nspr - security update
Description: Abhiskek Arya discovered an out of bounds write in the cvt_t() function of the NetScape Portable Runtime Library which could result in the execution of arbitrary code.
Family: unix Class: patch
Reference(s): DSA-2962-1
CVE-2014-1545
 Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
 Product(s): nspr
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25005
 
Oval ID: oval:org.mitre.oval:def:25005
Title: ELSA-2014:0741: firefox security update (Critical)
Description: Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2014-1533, CVE-2014-1538, CVE-2014-1541) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Christoph Diehl, Christian Holler, Hannes Verschore, Jan de Mooij, Ryan VanderMeulen, Jeff Walden, Kyle Huey, Abhishek Arya, and Nils as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 24.6.0 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 24.6.0 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
Family: unix Class: patch
Reference(s): ELSA-2014:0741-00
CVE-2014-1533
CVE-2014-1538
CVE-2014-1541
 Version: 4
Platform(s): Red Hat Enterprise Linux 7
Oracle Linux 6
Oracle Linux 5
 Product(s): firefox
xulrunner
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25038
 
Oval ID: oval:org.mitre.oval:def:25038
Title: DSA-2955-1 iceweasel - security update
Description: Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service.
Family: unix Class: patch
Reference(s): DSA-2955-1
CVE-2014-1533
CVE-2014-1538
CVE-2014-1541
CVE-2014-1545
 Version: 3
Platform(s): Debian GNU/Linux 7.0
Debian GNU/kFreeBSD 7.0
 Product(s): iceweasel
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25053
 
Oval ID: oval:org.mitre.oval:def:25053
Title: USN-2265-1 -- nspr vulnerability
Description: NSPR could be made to crash or run programs if it received specially crafted input.
Family: unix Class: patch
Reference(s): USN-2265-1
CVE-2014-1545
 Version: 3
Platform(s): Ubuntu 14.04
Ubuntu 13.10
Ubuntu 12.04
Ubuntu 10.04
 Product(s): nspr
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25064
 
Oval ID: oval:org.mitre.oval:def:25064
Title: USN-2250-1 -- thunderbird vulnerabilities
Description: Several security issues were fixed in Thunderbird.
Family: unix Class: patch
Reference(s): USN-2250-1
CVE-2014-1533
CVE-2014-1538
CVE-2014-1541
 Version: 3
Platform(s): Ubuntu 14.04
Ubuntu 13.10
Ubuntu 12.04
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25116
 
Oval ID: oval:org.mitre.oval:def:25116
Title: RHSA-2014:0917: nss and nspr security, bug fix, and enhancement update (Critical)
Description: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544) A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1544, CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber as the original reporters of CVE-2014-1544, Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. In addition, the nss package has been upgraded to upstream version 3.16.1, and the nspr package has been upgraded to upstream version 4.10.6. These updated packages provide a number of bug fixes and enhancements over the previous versions. (BZ#1112136, BZ#1112135) Users of NSS and NSPR are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.
Family: unix Class: patch
Reference(s): RHSA-2014:0917-00
CESA-2014:0917
CVE-2013-1740
CVE-2014-1490
CVE-2014-1491
CVE-2014-1492
CVE-2014-1544
CVE-2014-1545
 Version: 3
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
 Product(s): nspr
nss
nss-util
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25198
 
Oval ID: oval:org.mitre.oval:def:25198
Title: ELSA-2014:0742: thunderbird security update (Important)
Description: Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2014-1533, CVE-2014-1538, CVE-2014-1541) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Christoph Diehl, Christian Holler, Hannes Verschore, Jan de Mooij, Ryan VanderMeulen, Jeff Walden, Kyle Huey, Abhishek Arya, and Nils as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. For technical details regarding these flaws, refer to the Mozilla security advisories for Thunderbird 24.6.0. You can find a link to the Mozilla advisories in the References section of this erratum. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 24.6.0, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
Family: unix Class: patch
Reference(s): ELSA-2014:0742-00
CVE-2014-1533
CVE-2014-1538
CVE-2014-1541
 Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25411
 
Oval ID: oval:org.mitre.oval:def:25411
Title: SUSE-SU-2014:0824-3 -- Security update for MozillaFirefox
Description: MozillaFirefox was updated to version 24.6.0 to fix six security issues.
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0824-3
CVE-2014-1533
CVE-2014-1534
CVE-2014-1536
CVE-2014-1537
CVE-2014-1538
CVE-2014-1541
CVE-2014-1545
 Version: 5
Platform(s): SUSE Linux Enterprise Server 11
 Product(s): MozillaFirefox
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26119
 
Oval ID: oval:org.mitre.oval:def:26119
Title: ELSA-2014-1246 -- nss and nspr security, bug fix, and enhancement update (Moderate)
Description: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs: * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as "grep", could not handle failures properly. This update improves error detection in the specification file, and "grep" and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements.
Family: unix Class: patch
Reference(s): ELSA-2014-1246
CVE-2013-1740
CVE-2014-1490
CVE-2014-1491
CVE-2014-1492
CVE-2014-1545
 Version: 3
Platform(s): Oracle Linux 5
 Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26137
 
Oval ID: oval:org.mitre.oval:def:26137
Title: SUSE-SU-2014:0824-2 -- Security update for MozillaFirefox
Description: MozillaFirefox was updated to version 24.6.0 to fix six security issues.
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0824-2
CVE-2014-1533
CVE-2014-1534
CVE-2014-1536
CVE-2014-1537
CVE-2014-1538
CVE-2014-1541
CVE-2014-1545
 Version: 5
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Server 10
 Product(s): MozillaFirefox
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26138
 
Oval ID: oval:org.mitre.oval:def:26138
Title: SUSE-SU-2014:0824-1 -- Security update for MozillaFirefox
Description: MozillaFirefox was updated to version 24.6.0 to fix six security issues.
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0824-1
CVE-2014-1533
CVE-2014-1534
CVE-2014-1536
CVE-2014-1537
CVE-2014-1538
CVE-2014-1541
CVE-2014-1545
 Version: 5
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Server 10
SUSE Linux Enterprise Desktop 11
 Product(s): MozillaFirefox
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26284
 
Oval ID: oval:org.mitre.oval:def:26284
Title: SUSE-SU-2014:0905-1 -- Security update for Mozilla Firefox
Description: Mozilla Firefox has been updated to 24.6.0 to fix the security issues.
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0905-1
CVE-2014-1533
CVE-2014-1534
CVE-2014-1536
CVE-2014-1537
CVE-2014-1538
CVE-2014-1541
CVE-2014-1545
 Version: 5
Platform(s): SUSE Linux Enterprise Server 10
 Product(s): Mozilla Firefox
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26451
 
Oval ID: oval:org.mitre.oval:def:26451
Title: RHSA-2014:1246: nss and nspr security, bug fix, and enhancement update (Moderate)
Description: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs: * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as "grep", could not handle failures properly. This update improves error detection in the specification file, and "grep" and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements.
Family: unix Class: patch
Reference(s): RHSA-2014:1246-00
CVE-2013-1740
CVE-2014-1490
CVE-2014-1491
CVE-2014-1492
CVE-2014-1545
CESA-2014:1246
 Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
 Product(s): nss
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26703
 
Oval ID: oval:org.mitre.oval:def:26703
Title: RHSA-2014:1047: nss nad nspr bug fix and enhancement update (Moderate)
Description: Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.
Family: unix Class: patch
Reference(s): RHSA-2014:1047-00
CVE-2013-1740
CVE-2014-1490
CVE-2014-1491
CVE-2014-1492
CVE-2014-1545
 Version: 3
Platform(s): Red Hat Enterprise Linux 5
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27117
 
Oval ID: oval:org.mitre.oval:def:27117
Title: ELSA-2014-0917 -- nss and nspr security, bug fix, and enhancement update (critical)
Description: nspr [4.10.6-1] - Rebase to nspr-4.10.6 - Resolves: rhbz#1112135 nss [3.16.1-4.0.1.el6_5] - Added nss-vendor.patch to change vendor [3.16.1-4] - Update some patches on account of the rebase - Resolves: Bug 1099619 [3.16.1-3] - Backport nss-3.12.6 upstream fix required by Firefox 31 - Resolves: Bug 1099619 [3.16.1-2] - Remove two unused patches and apply a needed one that was missed - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1 [3.16.1-1] - Update to nss-3.16.1 - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1 nss-util [3.15.6-1] - Update to nss-3.16.1 - Resolves: rhbz#1112136
Family: unix Class: patch
Reference(s): ELSA-2014-0917
CVE-2013-1740
CVE-2014-1490
CVE-2014-1491
CVE-2014-1492
CVE-2014-1544
CVE-2014-1545
 Version: 3
Platform(s): Oracle Linux 6
 Product(s): nspr
nss
nss-util
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27237
 
Oval ID: oval:org.mitre.oval:def:27237
Title: DEPRECATED: ELSA-2014-0742 -- thunderbird security update (important)
Description: [24.6.0-1.0.1.el6_5] - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js [24.6.0-1] - Update to 24.6.0
Family: unix Class: patch
Reference(s): ELSA-2014-0742
CVE-2014-1533
CVE-2014-1538
CVE-2014-1541
 Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): thunderbird
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27326
 
Oval ID: oval:org.mitre.oval:def:27326
Title: DEPRECATED: ELSA-2014-0741 -- firefox security update (critical)
Description: [24.6.0-1.0.1.el6_5] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one [24.6.0-1] - Update to 24.6.0 ESR [24.5.0-2] - Disabled unused patches
Family: unix Class: patch
Reference(s): ELSA-2014-0741
CVE-2014-1533
CVE-2014-1538
CVE-2014-1541
 Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
 Product(s): firefox
xulrunner
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 359
Application 9
Application 44
Application 250

Information Assurance Vulnerability Management (IAVM)

Date Description
2014-06-12 IAVM : 2014-A-0082 - Multiple Vulnerabilities in Mozilla Products
Severity : Category I - VMSKEY : V0052487

Nessus® Vulnerability Scanner

Date Description
2016-05-18 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL16716.nasl - Type : ACT_GATHER_INFO
2015-04-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201504-01.nasl - Type : ACT_GATHER_INFO
2015-03-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-32.nasl - Type : ACT_GATHER_INFO
2015-03-19 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-059.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2014-0979.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-384.nasl - Type : ACT_GATHER_INFO
2014-10-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1246.nasl - Type : ACT_GATHER_INFO
2014-09-29 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140916_nss_and_nspr_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-09-18 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1246.nasl - Type : ACT_GATHER_INFO
2014-09-16 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1246.nasl - Type : ACT_GATHER_INFO
2014-08-20 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : seamonkey_2_26_1.nasl - Type : ACT_GATHER_INFO
2014-07-23 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140722_nss_and_nspr_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-07-23 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0917.nasl - Type : ACT_GATHER_INFO
2014-07-23 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0917.nasl - Type : ACT_GATHER_INFO
2014-07-23 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-0917.nasl - Type : ACT_GATHER_INFO
2014-07-03 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-2265-1.nasl - Type : ACT_GATHER_INFO
2014-07-02 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-448.nasl - Type : ACT_GATHER_INFO
2014-07-02 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-447.nasl - Type : ACT_GATHER_INFO
2014-06-23 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_Firefox-2014-06-140612.nasl - Type : ACT_GATHER_INFO
2014-06-23 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-432.nasl - Type : ACT_GATHER_INFO
2014-06-20 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2250-1.nasl - Type : ACT_GATHER_INFO
2014-06-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2962.nasl - Type : ACT_GATHER_INFO
2014-06-17 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2960.nasl - Type : ACT_GATHER_INFO
2014-06-16 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-125.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2243-1.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140610_thunderbird_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20140610_firefox_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2955.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2014-0742.nasl - Type : ACT_GATHER_INFO
2014-06-12 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2014-0741.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Mac OS X host contains a web browser that is potentially affected ...
File : macosx_firefox_24_6_esr.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_888a0262f0d911e3ba0cb4b52fce4ce8.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Mac OS X host contains a web browser that is affected by multiple ...
File : macosx_firefox_30.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Mac OS X host contains a mail client that is affected by multiple ...
File : macosx_thunderbird_24_6.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_24_6_esr.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_30.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_24_6.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-0741.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2014-0742.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0741.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-0742.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2014-06-13 13:25:02
  • Multiple Updates
2014-06-11 21:28:04
  • Multiple Updates
2014-06-11 17:25:36
  • Multiple Updates
2014-06-11 17:21:15
  • First insertion