Detections
Analytics

MiracleLinux 3 : nspr-4.9.5-2.AXS3, nss-3.14.3-18.AXS3 (AXSA:2013-664:03)

high Nessus Plugin ID 291466

Language:

Synopsis

The remote MiracleLinux host is missing one or more security updates.

Description

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-664:03 advisory.

 nss Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.
 nspr NSPR provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing and calendar time, basic memory management (malloc and free) and shared library linking.
 Security issues fixed with this release:
 CVE-2013-0791 The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted certificate.
 CVE-2013-1620 The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side- channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
 Fixed bugs:
 Previously, a defect in the FreeBL library implementation of the Diffie-Hellman (DH) protocol caused Openswan to drop connections; this has been fixed.
 Fixed a memory leak in the nssutil_ReadSecmodDB() function.
 nss now protects itself against being called before it has been properly initialized by the caller.
 Previously the certutil -H command did not describe the -F option. This has been fixed.
 Previously, a bug in the FreeBL library made the Openswan application generate a Key Exchange payload that was one byte shorter than what was required by the Diffie Hellman (DH) protocol, and Openswan would drop connections. This has been fixed.
 Previously, the remote-viewer utility failed to utilize a plugged-in smart card reader when a Spice client was running and the client could eventually crash. This has been fixed.
 Incorporated various GCM code fixes.
 Enhancement:
 Added support for the NIST Suite B set of recommended algorithms for Elliptic Curve Cryptography.
 After installation, applications using NSS or NSPR must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected nss, nss-devel and / or nss-tools packages.

See Also

https://tsn.miraclelinux.com/en/node/4344

Plugin Details

Severity: High

ID: 291466

File Name: miracle_linux_AXSA-2013-664.nasl

Version: 1.1

Type: local

Published: 1/19/2026

Updated: 1/19/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2013-1620

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:miracle:linux:3, p-cpe:/a:miracle:linux:nss-devel, p-cpe:/a:miracle:linux:nss-tools, p-cpe:/a:miracle:linux:nss

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/MiracleLinux/release, Host/MiracleLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/21/2013

Vulnerability Publication Date: 2/4/2013

Reference Information

CVE: CVE-2013-0791, CVE-2013-1620