Mandriva Linux Security Advisory : nss (MDVSA-2014:139)
Critical Nessus Plugin ID 76885
SynopsisThe remote Mandriva Linux host is missing one or more security updates.
DescriptionA vulnerability has been found and corrected in mozilla NSS :
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544).
The updated packages have been upgraded to the latest NSS (3.16.3) versions which is not vulnerable to this issue.
The nss 3.16.1 update done as part of MDVSA-2014:125 introduced a regression because of the upstream change: 'Imposed name constraints on the French government root CA ANSSI (DCISS)' The change wont work as currently implemented as the French government root CA signs more than 'gouv.fr' domains. So for now we revert that change until its properly fixed upstream (mga#13563).
Additionally the rootcerts package has also been updated to the latest version as of 2014-07-03, which adds, removes, and distrusts several certificates.
SolutionUpdate the affected packages.