HIGH7.5
Уязвимость набора библиотек Network Security Services, позволяющая нарушителю вызвать отказ в обслуживании или оказать другое воздействие
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PReferences
Severity:
Closed issues (7)
MEDIUM5.3
Уязвимость службы сетевой безопасности NSS браузеров Firefox, Firefox ESR и почтового клиента Thunderbird, позволяющая нарушителю оказать влияние на целостность данных
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:NReferences
HIGH7.5
A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html
- http://rhn.redhat.com/errata/RHSA-2016-2779.html
- http://www.securityfocus.com/bid/94349
- http://www.ubuntu.com/usn/USN-3163-1
- https://bto.bluecoat.com/security-advisory/sa137
- https://bugzilla.mozilla.org/show_bug.cgi?id=1306103
- https://security.gentoo.org/glsa/201701-46
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00037.html
- http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00049.html
- http://rhn.redhat.com/errata/RHSA-2016-2779.html
- http://www.securityfocus.com/bid/94349
- http://www.ubuntu.com/usn/USN-3163-1
- https://bto.bluecoat.com/security-advisory/sa137
- https://bugzilla.mozilla.org/show_bug.cgi?id=1306103
- https://security.gentoo.org/glsa/201701-46
MEDIUM5.9
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVSS 2.0MEDIUM 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:PCVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HCRITICAL9.8
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:PCVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
- http://www.debian.org/security/2017/dsa-3831
- http://www.debian.org/security/2017/dsa-3872
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/98050
- http://www.securitytracker.com/id/1038320
- https://access.redhat.com/errata/RHSA-2017:1100
- https://access.redhat.com/errata/RHSA-2017:1101
- https://access.redhat.com/errata/RHSA-2017:1102
- https://access.redhat.com/errata/RHSA-2017:1103
- https://bugzilla.mozilla.org/show_bug.cgi?id=1344380
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.28.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.29.5_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.30.1_release_notes
- https://security.gentoo.org/glsa/201705-04
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/#CVE-2017-5461
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/#CVE-2017-5461
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-13/#CVE-2017-5461
- https://www.oracle.com//security-alerts/cpujul2021.html
- http://www.debian.org/security/2017/dsa-3831
- http://www.debian.org/security/2017/dsa-3872
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/98050
- http://www.securitytracker.com/id/1038320
- https://access.redhat.com/errata/RHSA-2017:1100
- https://access.redhat.com/errata/RHSA-2017:1101
- https://access.redhat.com/errata/RHSA-2017:1102
- https://access.redhat.com/errata/RHSA-2017:1103
- https://bugzilla.mozilla.org/show_bug.cgi?id=1344380
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.28.4_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.29.5_release_notes
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.30.1_release_notes
- https://security.gentoo.org/glsa/201705-04
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5461
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/#CVE-2017-5461
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/#CVE-2017-5461
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-13/#CVE-2017-5461
- https://www.oracle.com//security-alerts/cpujul2021.html
MEDIUM5.3
A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS library has been updated to fix this issue to address this issue and Firefox ESR 52.1 has been updated with NSS version 3.28.4. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:P/A:NCVSS 3.xMEDIUM 5.3
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
- http://www.securityfocus.com/bid/97940
- http://www.securitytracker.com/id/1038320
- https://bugzilla.mozilla.org/show_bug.cgi?id=1345089
- https://security.gentoo.org/glsa/201705-04
- https://www.debian.org/security/2017/dsa-3831
- https://www.debian.org/security/2017/dsa-3872
- https://www.mozilla.org/security/advisories/mfsa2017-10/
- https://www.mozilla.org/security/advisories/mfsa2017-11/
- https://www.mozilla.org/security/advisories/mfsa2017-12/
- https://www.mozilla.org/security/advisories/mfsa2017-13/
- http://www.securityfocus.com/bid/97940
- http://www.securitytracker.com/id/1038320
- https://bugzilla.mozilla.org/show_bug.cgi?id=1345089
- https://security.gentoo.org/glsa/201705-04
- https://www.debian.org/security/2017/dsa-3831
- https://www.debian.org/security/2017/dsa-3872
- https://www.mozilla.org/security/advisories/mfsa2017-10/
- https://www.mozilla.org/security/advisories/mfsa2017-11/
- https://www.mozilla.org/security/advisories/mfsa2017-12/
- https://www.mozilla.org/security/advisories/mfsa2017-13/
HIGH7.5
Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:PCVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
- http://www.debian.org/security/2017/dsa-3872
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/98744
- http://www.securitytracker.com/id/1038579
- https://access.redhat.com/errata/RHSA-2017:1364
- https://access.redhat.com/errata/RHSA-2017:1365
- https://access.redhat.com/errata/RHSA-2017:1567
- https://access.redhat.com/errata/RHSA-2017:1712
- https://hg.mozilla.org/projects/nss/rev/55ea60effd0d
- http://www.debian.org/security/2017/dsa-3872
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/98744
- http://www.securitytracker.com/id/1038579
- https://access.redhat.com/errata/RHSA-2017:1364
- https://access.redhat.com/errata/RHSA-2017:1365
- https://access.redhat.com/errata/RHSA-2017:1567
- https://access.redhat.com/errata/RHSA-2017:1712
- https://hg.mozilla.org/projects/nss/rev/55ea60effd0d