Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title nss and nspr security update
Informations
Name RHSA-2015:1980 First vendor Publication 2015-11-04
Vendor RedHat Last vendor Modification 2015-11-04
Severity (Vendor) Critical Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated nss and nspr packages that fix three security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

2. Relevant releases/architectures:

RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64

3. Description:

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

A use-after-poison flaw and a heap-based buffer overflow flaw were found in the way NSS parsed certain ASN.1 structures. An attacker could use these flaws to cause NSS to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSS library. (CVE-2015-7181, CVE-2015-7182)

A heap-based buffer overflow was found in NSPR. An attacker could use this flaw to cause NSPR to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSPR library. (CVE-2015-7183)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Tyson Smith, David Keeler and Ryan Sleevi as the original reporter.

All nss and nspr users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1269345 - CVE-2015-7181 nss: use-after-poison in sec_asn1d_parse_leaf() (MFSA 2015-133) 1269351 - CVE-2015-7182 nss: ASN.1 decoder heap overflow when decoding constructed OCTET STRING that mixes indefinite and definite length encodings (MFSA 2015-133) 1269353 - CVE-2015-7183 nspr: heap-buffer overflow in PL_ARENA_ALLOCATE (MFSA 2015-133)

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2015-1980.html

CWE : Common Weakness Enumeration

% Id Name
75 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
25 % CWE-189 Numeric Errors (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 418
Application 8
Application 94
Application 1
Application 1
Application 1
Application 1
Application 2

Nessus® Vulnerability Scanner

Date Description
2016-10-06 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3688.nasl - Type : ACT_GATHER_INFO
2016-06-22 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0066.nasl - Type : ACT_GATHER_INFO
2016-06-22 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2016-0065.nasl - Type : ACT_GATHER_INFO
2016-05-31 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201605-06.nasl - Type : ACT_GATHER_INFO
2016-05-19 Name : The remote Debian host is missing a security update.
File : debian_DLA-480.nasl - Type : ACT_GATHER_INFO
2016-04-22 Name : The remote web server is affected by a remote code execution vulnerability.
File : glassfish_cpu_apr_2016.nasl - Type : ACT_GATHER_INFO
2016-04-21 Name : The remote web server is affected by a remote code execution vulnerability.
File : sun_java_web_server_7_0_23.nasl - Type : ACT_GATHER_INFO
2016-04-21 Name : The remote web proxy server is affected by a remote code execution vulnerabil...
File : iplanet_web_proxy_4_0_27.nasl - Type : ACT_GATHER_INFO
2016-02-19 Name : The remote device is missing a vendor-supplied security patch.
File : f5_bigip_SOL31372672.nasl - Type : ACT_GATHER_INFO
2016-01-21 Name : An application installed on the remote host is affected by multiple vulnerabi...
File : virtualbox_5_0_10.nasl - Type : ACT_GATHER_INFO
2016-01-04 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201512-10.nasl - Type : ACT_GATHER_INFO
2015-12-17 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-885.nasl - Type : ACT_GATHER_INFO
2015-12-16 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-877.nasl - Type : ACT_GATHER_INFO
2015-12-02 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2819-1.nasl - Type : ACT_GATHER_INFO
2015-12-02 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3410.nasl - Type : ACT_GATHER_INFO
2015-11-30 Name : The remote Windows host contains a mail client that is affected by multiple v...
File : mozilla_thunderbird_38_4.nasl - Type : ACT_GATHER_INFO
2015-11-30 Name : The remote Mac OS X host contains a mail client that is affected by multiple ...
File : macosx_thunderbird_38_4.nasl - Type : ACT_GATHER_INFO
2015-11-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3406.nasl - Type : ACT_GATHER_INFO
2015-11-30 Name : The remote Debian host is missing a security update.
File : debian_DLA-354.nasl - Type : ACT_GATHER_INFO
2015-11-25 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-2081-1.nasl - Type : ACT_GATHER_INFO
2015-11-20 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_9d04936c75f14a2c9ade4c1708be5df9.nasl - Type : ACT_GATHER_INFO
2015-11-20 Name : The remote Debian host is missing a security update.
File : debian_DLA-344.nasl - Type : ACT_GATHER_INFO
2015-11-18 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2015-2068.nasl - Type : ACT_GATHER_INFO
2015-11-13 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-1981-1.nasl - Type : ACT_GATHER_INFO
2015-11-13 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-1978-1.nasl - Type : ACT_GATHER_INFO
2015-11-10 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2015-1926-1.nasl - Type : ACT_GATHER_INFO
2015-11-10 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2015-718.nasl - Type : ACT_GATHER_INFO
2015-11-09 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2015-310-02.nasl - Type : ACT_GATHER_INFO
2015-11-06 Name : The remote OracleVM host is missing one or more security updates.
File : oraclevm_OVMSA-2015-0145.nasl - Type : ACT_GATHER_INFO
2015-11-06 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2015-608.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2015-1980.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2015-1981.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-3393.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Mac OS X host contains a web browser that is affected by multiple ...
File : macosx_firefox_38_4_esr.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Mac OS X host contains a web browser that is affected by multiple ...
File : macosx_firefox_42.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_38_4_esr.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Windows host contains a web browser that is affected by multiple v...
File : mozilla_firefox_42.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2015-1980.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2015-1981.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2015-1981.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20151104_nss__nss_util__and_nspr_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20151104_nss_and_nspr_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2785-1.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2790-1.nasl - Type : ACT_GATHER_INFO
2015-11-05 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2791-1.nasl - Type : ACT_GATHER_INFO
2015-11-04 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2015-1980.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
Date Informations
2016-01-22 09:26:40
  • Multiple Updates
2015-12-05 13:28:26
  • Multiple Updates
2015-11-06 13:24:27
  • Multiple Updates
2015-11-05 21:27:50
  • Multiple Updates
2015-11-05 13:23:55
  • Multiple Updates
2015-11-05 09:26:55
  • Multiple Updates
2015-11-04 17:21:25
  • First insertion