Mandriva Linux Security Advisory : nss (MDVSA-2014:139)

Critical Nessus Plugin ID 76885


The remote Mandriva Linux host is missing one or more security updates.


A vulnerability has been found and corrected in mozilla NSS :

Use-after-free vulnerability in the CERT_DestroyCertificate function in in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain (CVE-2014-1544).

The updated packages have been upgraded to the latest NSS (3.16.3) versions which is not vulnerable to this issue.

The nss 3.16.1 update done as part of MDVSA-2014:125 introduced a regression because of the upstream change: 'Imposed name constraints on the French government root CA ANSSI (DCISS)' The change wont work as currently implemented as the French government root CA signs more than '' domains. So for now we revert that change until its properly fixed upstream (mga#13563).

Additionally the rootcerts package has also been updated to the latest version as of 2014-07-03, which adds, removes, and distrusts several certificates.


Update the affected packages.

See Also

Plugin Details

Severity: Critical

ID: 76885

File Name: mandriva_MDVSA-2014-139.nasl

Version: $Revision: 1.4 $

Type: local

Published: 2014/07/30

Modified: 2014/09/05

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64nss-devel, p-cpe:/a:mandriva:linux:lib64nss-static-devel, p-cpe:/a:mandriva:linux:lib64nss3, p-cpe:/a:mandriva:linux:nss, p-cpe:/a:mandriva:linux:nss-doc, p-cpe:/a:mandriva:linux:rootcerts, p-cpe:/a:mandriva:linux:rootcerts-java, cpe:/o:mandriva:business_server:1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/07/29

Reference Information

CVE: CVE-2014-1544

BID: 68816

MDVSA: 2014:139