Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2015:059 | First vendor Publication | 2015-03-13 |
| Vendor | Mandriva | Last vendor Modification | 2015-03-13 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 10 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Multiple vulnerabilities has been found and corrected in the Mozilla NSS and NSPR packages: The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate (CVE-2014-1492). Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544). Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a signature malleability issue (CVE-2014-1568). The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00 (CVE-2014-1569). Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions (CVE-2014-1545). The sqlite3 packages have been upgraded to the 3.8.6 version due to an prerequisite to nss-3.17.x. Additionally the rootcerts package has also been updated to the latest version as of 2014-11-17, which adds, removes, and distrusts several certificates. The updated packages provides a solution for these security issues. |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2015:059 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-310 | Cryptographic Issues |
| 50 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:24484 | |||
| Oval ID: | oval:org.mitre.oval:def:24484 | ||
| Title: | USN-2159-1 -- nss vulnerability | ||
| Description: | NSS could be made to expose sensitive information over the network. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2159-1 CVE-2014-1492 | Version: | 5 |
| Platform(s): | Ubuntu 13.10 Ubuntu 12.10 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:24541 | |||
| Oval ID: | oval:org.mitre.oval:def:24541 | ||
| Title: | Incorrect IDNA domain name matching for wildcard certificates | ||
| Description: | The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2014-1492 | Version: | 11 |
| Platform(s): | Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows 8 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows XP | Product(s): | Mozilla Firefox Mozilla SeaMonkey |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:24891 | |||
| Oval ID: | oval:org.mitre.oval:def:24891 | ||
| Title: | DSA-2960-1 icedove - security update | ||
| Description: | Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2960-1 CVE-2014-1533 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | icedove |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:24914 | |||
| Oval ID: | oval:org.mitre.oval:def:24914 | ||
| Title: | Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain. | ||
| Description: | Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2014-1544 | Version: | 7 |
| Platform(s): | Microsoft Windows Server 2012 R2 Microsoft Windows 8.1 Microsoft Windows Server 2012 Microsoft Windows 8 Microsoft Windows Server 2008 R2 Microsoft Windows 7 Microsoft Windows Server 2008 Microsoft Windows Vista Microsoft Windows Server 2003 Microsoft Windows XP | Product(s): | Mozilla Firefox Mozilla Firefox ESR Mozilla Thunderbird |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:24988 | |||
| Oval ID: | oval:org.mitre.oval:def:24988 | ||
| Title: | DSA-2962-1 nspr - security update | ||
| Description: | Abhiskek Arya discovered an out of bounds write in the cvt_t() function of the NetScape Portable Runtime Library which could result in the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2962-1 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | nspr |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25038 | |||
| Oval ID: | oval:org.mitre.oval:def:25038 | ||
| Title: | DSA-2955-1 iceweasel - security update | ||
| Description: | Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code or denial of service. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2955-1 CVE-2014-1533 CVE-2014-1538 CVE-2014-1541 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | iceweasel |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25053 | |||
| Oval ID: | oval:org.mitre.oval:def:25053 | ||
| Title: | USN-2265-1 -- nspr vulnerability | ||
| Description: | NSPR could be made to crash or run programs if it received specially crafted input. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2265-1 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 Ubuntu 13.10 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | nspr |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25116 | |||
| Oval ID: | oval:org.mitre.oval:def:25116 | ||
| Title: | RHSA-2014:0917: nss and nspr security, bug fix, and enhancement update (Critical) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544) A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1544, CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber as the original reporters of CVE-2014-1544, Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. In addition, the nss package has been upgraded to upstream version 3.16.1, and the nspr package has been upgraded to upstream version 4.10.6. These updated packages provide a number of bug fixes and enhancements over the previous versions. (BZ#1112136, BZ#1112135) Users of NSS and NSPR are advised to upgrade to these updated packages, which correct these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:0917-00 CESA-2014:0917 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1544 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | nspr nss nss-util |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25335 | |||
| Oval ID: | oval:org.mitre.oval:def:25335 | ||
| Title: | RHSA-2014:0916: nss and nspr security update (Critical) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A race condition was found in the way NSS verified certain certificates. A remote attacker could use this flaw to crash an application using NSS or, possibly, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1544) Red Hat would like to thank the Mozilla project for reporting CVE-2014-1544. Upstream acknowledges Tyson Smith and Jesse Schwartzentruber as the original reporters. Users of NSS and NSPR are advised to upgrade to these updated packages, which correct this issue. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:0916-00 CESA-2014:0916 CVE-2014-1544 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 5 CentOS Linux 5 CentOS Linux 7 | Product(s): | nspr nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25501 | |||
| Oval ID: | oval:org.mitre.oval:def:25501 | ||
| Title: | SUSE-SU-2014:0665-1 -- Security update for Mozilla Firefox | ||
| Description: | This Mozilla Firefox and Mozilla NSS update fixes several security and non-security issues. Mozilla Firefox has been updated to 24.5.0esr which fixes the following issues: * MFSA 2014-34/CVE-2014-1518 Miscellaneous memory safety hazards * MFSA 2014-37/CVE-2014-1523 Out of bounds read while decoding JPG images * MFSA 2014-38/CVE-2014-1524 Buffer overflow when using non-XBL object as XBL * MFSA 2014-42/CVE-2014-1529 Privilege escalation through Web Notification API * MFSA 2014-43/CVE-2014-1530 Cross-site scripting (XSS) using history navigations * MFSA 2014-44/CVE-2014-1531 Use-after-free in imgLoader while resizing images * MFSA 2014-46/CVE-2014-1532 Use-after-free in nsHostResolver Mozilla NSS has been updated to 3.16 * required for Firefox 29 * CVE-2014-1492_ In a wildcard certificate, the wildcard character should not be embedded within the U-label of an internationalized domain name. See the last bullet point in RFC 6125, Section 7.2. * Update of root certificates. | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:0665-1 CVE-2014-1518 CVE-2014-1523 CVE-2014-1524 CVE-2014-1529 CVE-2014-1530 CVE-2014-1531 CVE-2014-1532 CVE-2014-1492 | Version: | 5 |
| Platform(s): | SUSE Linux Enterprise Server 11 | Product(s): | Mozilla Firefox |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26119 | |||
| Oval ID: | oval:org.mitre.oval:def:26119 | ||
| Title: | ELSA-2014-1246 -- nss and nspr security, bug fix, and enhancement update (Moderate) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs: * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as "grep", could not handle failures properly. This update improves error detection in the specification file, and "grep" and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014-1246 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Oracle Linux 5 | Product(s): | nss |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:26141 | |||
| Oval ID: | oval:org.mitre.oval:def:26141 | ||
| Title: | DSA-2994-1 -- nss - security update | ||
| Description: | Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2994-1 CVE-2013-1741 CVE-2013-5606 CVE-2014-1491 CVE-2014-1492 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 7 Debian GNU/kFreeBSD 7 | Product(s): | nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26168 | |||
| Oval ID: | oval:org.mitre.oval:def:26168 | ||
| Title: | RHSA-2014:1073: nss, nss-util, nss-softokn security, bug fix, and enhancement update (Low) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSLv3, TLS, and other security standards. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:1073-00 CESA-2014:1073 CVE-2014-1492 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 7 CentOS Linux 7 | Product(s): | nss nss-softokn nss-util |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26268 | |||
| Oval ID: | oval:org.mitre.oval:def:26268 | ||
| Title: | USN-2343-1 -- nss vulnerability | ||
| Description: | NSS could be made to crash or run programs as your login if it processed a specially crafted certificate. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2343-1 CVE-2014-1544 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26436 | |||
| Oval ID: | oval:org.mitre.oval:def:26436 | ||
| Title: | SUSE-SU-2014:1220-3 -- Security update for mozilla-nss | ||
| Description: | Mozilla NSS was updated to version 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:1220-3 CVE-2014-1568 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Server 10 | Product(s): | mozilla-nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26451 | |||
| Oval ID: | oval:org.mitre.oval:def:26451 | ||
| Title: | RHSA-2014:1246: nss and nspr security, bug fix, and enhancement update (Moderate) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. (CVE-2013-1740) A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077. An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application. (CVE-2014-1490) It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters. This could possibly lead to weak encryption being used in communication between the client and the server. (CVE-2014-1491) An out-of-bounds write flaw was found in NSPR. A remote attacker could potentially use this flaw to crash an application using NSPR or, possibly, execute arbitrary code with the privileges of the user running that application. This NSPR flaw was not exposed to web content in any shipped version of Firefox. (CVE-2014-1545) It was found that the implementation of Internationalizing Domain Names in Applications (IDNA) hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid. (CVE-2014-1492) Red Hat would like to thank the Mozilla project for reporting the CVE-2014-1490, CVE-2014-1491, and CVE-2014-1545 issues. Upstream acknowledges Brian Smith as the original reporter of CVE-2014-1490, Antoine Delignat-Lavaud and Karthikeyan Bhargavan as the original reporters of CVE-2014-1491, and Abhishek Arya as the original reporter of CVE-2014-1545. The nss and nspr packages have been upgraded to upstream version 3.16.1 and 4.10.6 respectively, which provide a number of bug fixes and enhancements over the previous versions. (BZ#1110857, BZ#1110860) This update also fixes the following bugs: * Previously, when the output.log file was not present on the system, the shell in the Network Security Services (NSS) specification handled test failures incorrectly as false positive test results. Consequently, certain utilities, such as "grep", could not handle failures properly. This update improves error detection in the specification file, and "grep" and other utilities now handle missing files or crashes as intended. (BZ#1035281) * Prior to this update, a subordinate Certificate Authority (CA) of the ANSSI agency incorrectly issued an intermediate certificate installed on a network monitoring device. As a consequence, the monitoring device was enabled to act as an MITM (Man in the Middle) proxy performing traffic management of domain names or IP addresses that the certificate holder did not own or control. The trust in the intermediate certificate to issue the certificate for an MITM device has been revoked, and such a device can no longer be used for MITM attacks. (BZ#1042684) * Due to a regression, MD5 certificates were rejected by default because Network Security Services (NSS) did not trust MD5 certificates. With this update, MD5 certificates are supported in Red Hat Enterprise Linux 5. (BZ#11015864) Users of nss and nspr are advised to upgrade to these updated packages, which correct these issues and add these enhancements. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:1246-00 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1545 CESA-2014:1246 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26453 | |||
| Oval ID: | oval:org.mitre.oval:def:26453 | ||
| Title: | USN-2361-1 -- nss vulnerability | ||
| Description: | Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2361-1 CVE-2014-1568 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26574 | |||
| Oval ID: | oval:org.mitre.oval:def:26574 | ||
| Title: | DSA-3033-1 nss - security update | ||
| Description: | Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS (the Mozilla Network Security Service library) was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-3033-1 CVE-2014-1568 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26586 | |||
| Oval ID: | oval:org.mitre.oval:def:26586 | ||
| Title: | USN-2360-2 -- thunderbird vulnerabilities | ||
| Description: | Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2360-2 CVE-2014-1568 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 Ubuntu 12.04 | Product(s): | thunderbird |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26703 | |||
| Oval ID: | oval:org.mitre.oval:def:26703 | ||
| Title: | RHSA-2014:1047: nss nad nspr bug fix and enhancement update (Moderate) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:1047-00 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Red Hat Enterprise Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:26709 | |||
| Oval ID: | oval:org.mitre.oval:def:26709 | ||
| Title: | SUSE-SU-2014:1220-4 -- Security update for mozilla-nss | ||
| Description: | Mozilla NSS was updated to version 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:1220-4 CVE-2014-1568 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 10 | Product(s): | mozilla-nss |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:26725 | |||
| Oval ID: | oval:org.mitre.oval:def:26725 | ||
| Title: | RHSA-2014:1307: nss security update (Important) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS parsed ASN.1 (Abstract Syntax Notation One) input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. (CVE-2014-1568) Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Antoine Delignat-Lavaud and Intel Product Security Incident Response Team as the original reporters. All NSS users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, applications using NSS must be restarted for this update to take effect. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2014:1307-00 CESA-2014:1307 CVE-2014-1568 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 5 CentOS Linux 7 CentOS Linux 6 CentOS Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26832 | |||
| Oval ID: | oval:org.mitre.oval:def:26832 | ||
| Title: | USN-2360-1 -- firefox vulnerabilities | ||
| Description: | Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2360-1 CVE-2014-1568 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 Ubuntu 12.04 | Product(s): | firefox |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26842 | |||
| Oval ID: | oval:org.mitre.oval:def:26842 | ||
| Title: | DSA-3034-1 iceweasel - security update | ||
| Description: | Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS (the Mozilla Network Security Service library, embedded in Wheezy's Iceweasel package), was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-3034-1 CVE-2014-1568 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | iceweasel |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26891 | |||
| Oval ID: | oval:org.mitre.oval:def:26891 | ||
| Title: | DSA-3037-1 icedove - security update | ||
| Description: | Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS (the Mozilla Network Security Service library, embedded in Wheezy's Icedove), was parsing ASN.1 data used in signatures, making it vulnerable to a signature forgery attack. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-3037-1 CVE-2014-1568 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | icedove |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26948 | |||
| Oval ID: | oval:org.mitre.oval:def:26948 | ||
| Title: | SUSE-SU-2014:1220-2 -- Security update for mozilla-nss | ||
| Description: | Mozilla NSS was updated to 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:1220-2 CVE-2014-1568 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 | Product(s): | mozilla-nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27025 | |||
| Oval ID: | oval:org.mitre.oval:def:27025 | ||
| Title: | SUSE-SU-2014:1220-1 -- Security update for mozilla-nss | ||
| Description: | Mozilla NSS was updated to version 3.16.5 to fix a RSA certificate forgery issue. MFSA 2014-73 / CVE-2014-1568: Antoine Delignat-Lavaud, security researcher at Inria Paris in team Prosecco, reported an issue in Network Security Services (NSS) libraries affecting all versions. He discovered that NSS is vulnerable to a variant of a signature forgery attack previously published by Daniel Bleichenbacher. This is due to lenient parsing of ASN.1 values involved in a signature and could lead to the forging of RSA certificates. The Advanced Threat Research team at Intel Security also independently discovered and reported this issue. Security Issues: * CVE-2014-1568 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1568> | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:1220-1 CVE-2014-1568 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | mozilla-nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27058 | |||
| Oval ID: | oval:org.mitre.oval:def:27058 | ||
| Title: | ELSA-2014-1307 -- nss security update (Important) | ||
| Description: | Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities. A flaw was found in the way NSS parsed ASN.1 (Abstract Syntax Notation One) input from certain RSA signatures. A remote attacker could use this flaw to forge RSA certificates by providing a specially crafted signature to an application using NSS. (CVE-2014-1568) Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Antoine Delignat-Lavaud and Intel Product Security Incident Response Team as the original reporters. All NSS users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, applications using NSS must be restarted for this update to take effect. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014-1307 CVE-2014-1568 | Version: | 3 |
| Platform(s): | Oracle Linux 7 Oracle Linux 5 Oracle Linux 6 | Product(s): | nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27117 | |||
| Oval ID: | oval:org.mitre.oval:def:27117 | ||
| Title: | ELSA-2014-0917 -- nss and nspr security, bug fix, and enhancement update (critical) | ||
| Description: | nspr [4.10.6-1] - Rebase to nspr-4.10.6 - Resolves: rhbz#1112135 nss [3.16.1-4.0.1.el6_5] - Added nss-vendor.patch to change vendor [3.16.1-4] - Update some patches on account of the rebase - Resolves: Bug 1099619 [3.16.1-3] - Backport nss-3.12.6 upstream fix required by Firefox 31 - Resolves: Bug 1099619 [3.16.1-2] - Remove two unused patches and apply a needed one that was missed - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1 [3.16.1-1] - Update to nss-3.16.1 - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS 3.16.1 nss-util [3.15.6-1] - Update to nss-3.16.1 - Resolves: rhbz#1112136 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014-0917 CVE-2013-1740 CVE-2014-1490 CVE-2014-1491 CVE-2014-1492 CVE-2014-1544 CVE-2014-1545 | Version: | 3 |
| Platform(s): | Oracle Linux 6 | Product(s): | nspr nss nss-util |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27274 | |||
| Oval ID: | oval:org.mitre.oval:def:27274 | ||
| Title: | ELSA-2014-0916 -- nss and nspr security update (critical) | ||
| Description: | nspr [4.10.2-4] - Rebase to nspr-4.10.6 - Resolves: Bug 1116199 [4.10.2-3] - Retagging - Resolves: rhbz#1032466 nss [3.15.3-7] - Remove an unused patch - Related: Bug 1116199 [3.15.3-6] - Fix race-condition in certificate validation - Resolves: Bug 1116199 [3.15.3-5] - Remove two unused patches - Resolves: Bug 1042683 - nss: Mis-issued ANSSI/DCSSI certificate (MFSA 2013-117) | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2014-0916 CVE-2014-1544 | Version: | 3 |
| Platform(s): | Oracle Linux 5 | Product(s): | nspr nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27684 | |||
| Oval ID: | oval:org.mitre.oval:def:27684 | ||
| Title: | DSA-3071-1 -- nss security update | ||
| Description: | In nss, a set of libraries designed to support cross-platform development of security-enabled client and server applications, Tyson Smith and Jesse Schwartzentruber discovered a use-after-free vulnerability that allows remote attackers to execute arbitrary code by triggering the improper removal of an NSSCertificate structure from a trust domain. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-3071-1 CVE-2014-1544 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | nss |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:28150 | |||
| Oval ID: | oval:org.mitre.oval:def:28150 | ||
| Title: | SUSE-SU-2014:1510-1 -- Security update for MozillaFirefox and mozilla-nss (moderate) | ||
| Description: | - update to Firefox 31.2.0 ESR (bnc#900941) * MFSA 2014-74/CVE-2014-1574/CVE-2014-1575 (bmo#1001994, bmo#1011354, bmo#1018916, bmo#1020034, bmo#1023035, bmo#1032208, bmo#1033020, bmo#1034230, bmo#1061214, bmo#1061600, bmo#1064346, bmo#1072044, bmo#1072174) Miscellaneous memory safety hazards (rv:33.0/rv:31.2) * MFSA 2014-75/CVE-2014-1576 (bmo#1041512) Buffer overflow during CSS manipulation * MFSA 2014-76/CVE-2014-1577 (bmo#1012609) Web Audio memory corruption issues with custom waveforms * MFSA 2014-77/CVE-2014-1578 (bmo#1063327) Out-of-bounds write with WebM video * MFSA 2014-79/CVE-2014-1581 (bmo#1068218) Use-after-free interacting with text directionality * MFSA 2014-81/CVE-2014-1585/CVE-2014-1586 (bmo#1062876, bmo#1062981) Inconsistent video sharing within iframe * MFSA 2014-82/CVE-2014-1583 (bmo#1015540) Accessing cross-origin objects via the Alarms API - SSLv3 is disabled by default. See README.POODLE for more detailed information. - disable call home features - update to 3.17.2 (bnc#900941) Bugfix release * bmo#1049435 - Importing an RSA private key fails if p < q * bmo#1057161 - NSS hangs with 100% CPU on invalid EC key * bmo#1078669 - certutil crashes when using the --certVersion parameter - changes from earlier version of the 3.17 branch: update to 3.17.1 (bnc#897890) * MFSA 2014-73/CVE-2014-1568 (bmo#1064636, bmo#1069405) RSA Signature Forgery in NSS * Change library's signature algorithm default to SHA256 * Add support for draft-ietf-tls-downgrade-scsv * Add clang-cl support to the NSS build system * Implement TLS 1.3: * Part 1. Negotiate TLS 1.3 * Part 2. Remove deprecated cipher suites andcompression. * Add support for little-endian powerpc64 update to 3.17 * required for Firefox 33 New functionality: * When using ECDHE, the TLS server code may be configured to generate a fresh ephemeral ECDH key for each handshake, by setting the SSL_REUSE_SERVER_ECDHE_KEY socket option to PR_FALSE. The SSL_REUSE_SERVER_ECDHE_KEY option defaults to PR_TRUE, which means the server's ephemeral ECDH key is reused for multiple handshakes. This option does not affect the TLS client code, which always generates a fresh ephemeral ECDH key for each handshake. New Macros * SSL_REUSE_SERVER_ECDHE_KEY Notable Changes: * The manual pages for the certutil and pp tools have been updated to document the new parameters that had been added in NSS 3.16.2. | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:1510-1 CVE-2014-1574 CVE-2014-1575 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1585 CVE-2014-1586 CVE-2014-1583 CVE-2014-1568 | Version: | 5 |
| Platform(s): | SUSE Linux Enterprise Desktop 12 | Product(s): | MozillaFirefox mozilla-nss |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2015-07-16 | IAVM : 2015-A-0154 - Multiple Vulnerabilities in Oracle Fusion Middleware Severity : Category I - VMSKEY : V0061081 |
| 2014-07-24 | IAVM : 2014-A-0113 - Multiple Vulnerabilities in Mozilla Products Severity : Category I - VMSKEY : V0053309 |
| 2014-06-12 | IAVM : 2014-A-0082 - Multiple Vulnerabilities in Mozilla Products Severity : Category I - VMSKEY : V0052487 |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2015-04-02 | Network Security Services NSS library RSA signature forgery attempt RuleID : 33664 - Revision : 2 - Type : BROWSER-OTHER |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-06-23 | Name : The remote device is affected by multiple vulnerabilities. File : juniper_space_jsa10698.nasl - Type : ACT_GATHER_INFO |
| 2016-06-22 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0066.nasl - Type : ACT_GATHER_INFO |
| 2016-05-18 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL16716.nasl - Type : ACT_GATHER_INFO |
| 2015-07-23 | Name : The remote proxy web server is affected by a remote code injection vulnerabil... File : iplanet_web_proxy_4_0_26.nasl - Type : ACT_GATHER_INFO |
| 2015-07-23 | Name : The remote web server is affected by a remote code injection vulnerability. File : sun_java_web_server_7_0_22.nasl - Type : ACT_GATHER_INFO |
| 2015-07-16 | Name : The remote web server is affected by multiple vulnerabilities. File : glassfish_cpu_jul_2015.nasl - Type : ACT_GATHER_INFO |
| 2015-05-29 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-529.nasl - Type : ACT_GATHER_INFO |
| 2015-05-29 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-530.nasl - Type : ACT_GATHER_INFO |
| 2015-05-29 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-531.nasl - Type : ACT_GATHER_INFO |
| 2015-05-29 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-532.nasl - Type : ACT_GATHER_INFO |
| 2015-05-29 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-533.nasl - Type : ACT_GATHER_INFO |
| 2015-05-27 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-1510-1.nasl - Type : ACT_GATHER_INFO |
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-0665-1.nasl - Type : ACT_GATHER_INFO |
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-0665-2.nasl - Type : ACT_GATHER_INFO |
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-0727-1.nasl - Type : ACT_GATHER_INFO |
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-0076-1.nasl - Type : ACT_GATHER_INFO |
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-0171-1.nasl - Type : ACT_GATHER_INFO |
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-0173-1.nasl - Type : ACT_GATHER_INFO |
| 2015-04-22 | Name : The remote proxy web server is affected by a signature forgery vulnerability. File : iplanet_web_proxy_4_0_25.nasl - Type : ACT_GATHER_INFO |
| 2015-04-22 | Name : The remote web server is affected by a signature forgery vulnerability. File : sun_java_web_server_7_0_21.nasl - Type : ACT_GATHER_INFO |
| 2015-04-20 | Name : The remote web server is affected by multiple vulnerabilities. File : glassfish_cpu_apr_2015.nasl - Type : ACT_GATHER_INFO |
| 2015-04-08 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201504-01.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-154.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-23.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-32.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-62.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-89.nasl - Type : ACT_GATHER_INFO |
| 2015-03-19 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-059.nasl - Type : ACT_GATHER_INFO |
| 2015-03-17 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3186.nasl - Type : ACT_GATHER_INFO |
| 2015-03-02 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-185.nasl - Type : ACT_GATHER_INFO |
| 2015-02-02 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_firefox-201501-150126.nasl - Type : ACT_GATHER_INFO |
| 2015-02-02 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_firefox-201501-150127.nasl - Type : ACT_GATHER_INFO |
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_firefox_20141216.nasl - Type : ACT_GATHER_INFO |
| 2015-01-08 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2014-16530.nasl - Type : ACT_GATHER_INFO |
| 2015-01-08 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2452-1.nasl - Type : ACT_GATHER_INFO |
| 2014-12-26 | Name : The remote Fedora host is missing a security update. File : fedora_2014-17085.nasl - Type : ACT_GATHER_INFO |
| 2014-12-16 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-252.nasl - Type : ACT_GATHER_INFO |
| 2014-12-15 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2014-0082.nasl - Type : ACT_GATHER_INFO |
| 2014-12-04 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_7ae618709dd24884a2f2f19bb5784d09.nasl - Type : ACT_GATHER_INFO |
| 2014-12-02 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_34.nasl - Type : ACT_GATHER_INFO |
| 2014-12-02 | Name : The remote Mac OS X host contains a mail client that is affected by multiple ... File : macosx_thunderbird_31_3.nasl - Type : ACT_GATHER_INFO |
| 2014-12-02 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_31_3_esr.nasl - Type : ACT_GATHER_INFO |
| 2014-12-02 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_34.nasl - Type : ACT_GATHER_INFO |
| 2014-12-02 | Name : The remote Windows host contains a mail client that is affected by multiple v... File : mozilla_thunderbird_31_3.nasl - Type : ACT_GATHER_INFO |
| 2014-11-26 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2014-0023.nasl - Type : ACT_GATHER_INFO |
| 2014-11-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3071.nasl - Type : ACT_GATHER_INFO |
| 2014-11-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0915.nasl - Type : ACT_GATHER_INFO |
| 2014-11-08 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2014-0979.nasl - Type : ACT_GATHER_INFO |
| 2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1165.nasl - Type : ACT_GATHER_INFO |
| 2014-11-08 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2014-1354.nasl - Type : ACT_GATHER_INFO |
| 2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1371.nasl - Type : ACT_GATHER_INFO |
| 2014-10-31 | Name : The remote host is affected by multiple vulnerabilities. File : oracle_opensso_agent_cpu_oct_2014.nasl - Type : ACT_GATHER_INFO |
| 2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-384.nasl - Type : ACT_GATHER_INFO |
| 2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-385.nasl - Type : ACT_GATHER_INFO |
| 2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-422.nasl - Type : ACT_GATHER_INFO |
| 2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-423.nasl - Type : ACT_GATHER_INFO |
| 2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-424.nasl - Type : ACT_GATHER_INFO |
| 2014-10-12 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2014-11565.nasl - Type : ACT_GATHER_INFO |
| 2014-10-01 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1246.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1307.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3037.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2014-11518.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2014-11632.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-562.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1307.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140916_nss_and_nspr_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140926_nss_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2014-09-29 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libfreebl3-140925.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3033.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3034.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_48108fb0751c4cbb8f3309239ead4b55.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_bd2ef267448511e4b0b700262d5ed8ee.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Mac OS X host contains a web browser that is affected by a signatu... File : macosx_firefox_24_8_1_esr.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Mac OS X host contains a web browser that is affected by a signatu... File : macosx_firefox_31_1_1_esr.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Mac OS X host contains a web browser that is affected by a signatu... File : macosx_firefox_32_0_3.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Mac OS X host contains a mail client that is affected by a signatu... File : macosx_thunderbird_24_8_1.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Mac OS X host contains a mail client that is affected by a signatu... File : macosx_thunderbird_31_1_2.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-189.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Windows host contains a web browser that is affected by a signatur... File : mozilla_firefox_24_8_1_esr.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Windows host contains a web browser that is affected by a signatur... File : mozilla_firefox_31_1_1_esr.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Windows host contains a web browser that is affected by a signatur... File : mozilla_firefox_32_0_3.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Windows host contains a mail client that is affected by a signatur... File : mozilla_thunderbird_24_8_1.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Windows host contains a mail client that is affected by a signatur... File : mozilla_thunderbird_31_1_2.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1307.nasl - Type : ACT_GATHER_INFO |
| 2014-09-26 | Name : The remote Windows host contains a web browser that is affected by a signatur... File : seamonkey_2_29_1.nasl - Type : ACT_GATHER_INFO |
| 2014-09-25 | Name : The remote Windows host contains a web browser that is affected by a signatur... File : google_chrome_37_0_2062_124.nasl - Type : ACT_GATHER_INFO |
| 2014-09-25 | Name : The remote Mac OS X host contains a web browser that is affected by a signatu... File : macosx_google_chrome_37_0_2062_124.nasl - Type : ACT_GATHER_INFO |
| 2014-09-25 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2360-1.nasl - Type : ACT_GATHER_INFO |
| 2014-09-25 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2360-2.nasl - Type : ACT_GATHER_INFO |
| 2014-09-25 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2361-1.nasl - Type : ACT_GATHER_INFO |
| 2014-09-18 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1246.nasl - Type : ACT_GATHER_INFO |
| 2014-09-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1246.nasl - Type : ACT_GATHER_INFO |
| 2014-09-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2343-1.nasl - Type : ACT_GATHER_INFO |
| 2014-08-19 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1073.nasl - Type : ACT_GATHER_INFO |
| 2014-08-19 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1073.nasl - Type : ACT_GATHER_INFO |
| 2014-08-19 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1073.nasl - Type : ACT_GATHER_INFO |
| 2014-08-12 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-487.nasl - Type : ACT_GATHER_INFO |
| 2014-08-04 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2996.nasl - Type : ACT_GATHER_INFO |
| 2014-08-04 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_firefox-201407-140729.nasl - Type : ACT_GATHER_INFO |
| 2014-08-04 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_firefox-201407-140730.nasl - Type : ACT_GATHER_INFO |
| 2014-08-01 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2994.nasl - Type : ACT_GATHER_INFO |
| 2014-08-01 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-476.nasl - Type : ACT_GATHER_INFO |
| 2014-07-31 | Name : The remote host is running software with multiple vulnerabilities. File : oracle_traffic_director_july_2014_cpu.nasl - Type : ACT_GATHER_INFO |
| 2014-07-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-139.nasl - Type : ACT_GATHER_INFO |
| 2014-07-30 | Name : The remote openSUSE host is missing a security update. File : suse_12_3_openSUSE-2014--140725.nasl - Type : ACT_GATHER_INFO |
| 2014-07-30 | Name : The remote openSUSE host is missing a security update. File : suse_13_1_openSUSE-2014--140725.nasl - Type : ACT_GATHER_INFO |
| 2014-07-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2986.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_978b0f76122d11e4afe3bc5ff4fb5e7b.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_24_7_esr.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_31.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Mac OS X host contains a mail client that is affected by multiple ... File : macosx_thunderbird_24_7.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Mac OS X host contains a mail client that is affected by multiple ... File : macosx_thunderbird_31_0.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_24_7_esr.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_31.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Windows host contains a mail client that is affected by multiple v... File : mozilla_thunderbird_24_7.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Windows host contains a mail client that is affected by multiple v... File : mozilla_thunderbird_31_0.nasl - Type : ACT_GATHER_INFO |
| 2014-07-24 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0916.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0916.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-0917.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-0917.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0916.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-0917.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140722_nss_and_nspr_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20140722_nss_and_nspr_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2295-1.nasl - Type : ACT_GATHER_INFO |
| 2014-07-23 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2296-1.nasl - Type : ACT_GATHER_INFO |
| 2014-07-18 | Name : The remote web server is affected by multiple vulnerabilities. File : glassfish_cpu_jul_2014.nasl - Type : ACT_GATHER_INFO |
| 2014-07-18 | Name : A web proxy server on the remote host is affected by multiple vulnerabilities. File : iplanet_web_proxy_4_0_24.nasl - Type : ACT_GATHER_INFO |
| 2014-07-18 | Name : The remote web server is affected by multiple vulnerabilities. File : sun_java_web_server_7_0_20.nasl - Type : ACT_GATHER_INFO |
| 2014-07-03 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2265-1.nasl - Type : ACT_GATHER_INFO |
| 2014-07-02 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-447.nasl - Type : ACT_GATHER_INFO |
| 2014-07-02 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-448.nasl - Type : ACT_GATHER_INFO |
| 2014-06-23 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-432.nasl - Type : ACT_GATHER_INFO |
| 2014-06-23 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_Firefox-2014-06-140612.nasl - Type : ACT_GATHER_INFO |
| 2014-06-18 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2962.nasl - Type : ACT_GATHER_INFO |
| 2014-06-17 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2960.nasl - Type : ACT_GATHER_INFO |
| 2014-06-16 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-125.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-336.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-354.nasl - Type : ACT_GATHER_INFO |
| 2014-06-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2955.nasl - Type : ACT_GATHER_INFO |
| 2014-06-11 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_888a0262f0d911e3ba0cb4b52fce4ce8.nasl - Type : ACT_GATHER_INFO |
| 2014-05-14 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_MozillaFirefox-201404-140501.nasl - Type : ACT_GATHER_INFO |
| 2014-05-03 | Name : The remote Fedora host is missing one or more security updates. File : fedora_2014-5829.nasl - Type : ACT_GATHER_INFO |
| 2014-04-30 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_985d4d6ccfbd11e3a003b4b52fce4ce8.nasl - Type : ACT_GATHER_INFO |
| 2014-04-30 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2185-1.nasl - Type : ACT_GATHER_INFO |
| 2014-04-29 | Name : The remote Mac OS X host contains a web browser that is potentially affected ... File : macosx_firefox_29.nasl - Type : ACT_GATHER_INFO |
| 2014-04-29 | Name : The remote Windows host contains a web browser that is potentially affected b... File : mozilla_firefox_29.nasl - Type : ACT_GATHER_INFO |
| 2014-04-29 | Name : The remote Windows host contains a web browser that is potentially affected b... File : seamonkey_2_26.nasl - Type : ACT_GATHER_INFO |
| 2014-04-03 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2159-1.nasl - Type : ACT_GATHER_INFO |
| 2014-03-31 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2014-086-04.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2016-01-22 09:26:26 |
|
| 2015-03-20 13:29:05 |
|
| 2015-03-13 17:22:12 |
|
