New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.
VPR Score: 5.9
Synopsis
The remote openSUSE host is missing a security update.
Description
The Mozilla NSS libraries were updated to version 3.13.1 to fix various bugs and security problems.
Following security issues were fixed :
- SSL 2.0 is disabled by default
- A defense against the SSL 3.0 and TLS 1.0 CBC chosen plaintext attack demonstrated by Rizzo and Duong (CVE-2011-3389) is enabled by default. Set the SSL_CBC_RANDOM_IV SSL option to PR_FALSE to disable it.
bnc#
- SHA-224 is supported
- NSS_NoDB_Init does not try to open /pkcs11.txt and /secmod.db anymore (bmo#641052, bnc#726096) (CVE-2011-3640)
Also following bugs were fixed :
- fix spec file syntax for qemu-workaround
- Added a patch to fix errors in the pkcs11n.h header file. (bmo#702090)
- better SHA-224 support (bmo#647706)
- SHA-224 is supported
- Added PORT_ErrorToString and PORT_ErrorToName to return the error message and symbolic name of an NSS error code
- Added NSS_GetVersion to return the NSS version string
- Added experimental support of RSA-PSS to the softoken only
Solution
Update the affected nss-201112 packages.