SUSE SLED12 / SLES12 Security Update : MozillaFirefox / mozilla-nss (SUSE-SU-2014:1510-1)

High Nessus Plugin ID 83849

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 5.9


The remote SUSE host is missing one or more security updates.


- update to Firefox 31.2.0 ESR (bnc#900941)

- MFSA 2014-74/CVE-2014-1574/CVE-2014-1575 (bmo#1001994, bmo#1011354, bmo#1018916, bmo#1020034, bmo#1023035, bmo#1032208, bmo#1033020, bmo#1034230, bmo#1061214, bmo#1061600, bmo#1064346, bmo#1072044, bmo#1072174) Miscellaneous memory safety hazards (rv:33.0/rv:31.2)

- MFSA 2014-75/CVE-2014-1576 (bmo#1041512) Buffer overflow during CSS manipulation

- MFSA 2014-76/CVE-2014-1577 (bmo#1012609) Web Audio memory corruption issues with custom waveforms

- MFSA 2014-77/CVE-2014-1578 (bmo#1063327) Out-of-bounds write with WebM video

- MFSA 2014-79/CVE-2014-1581 (bmo#1068218) Use-after-free interacting with text directionality

- MFSA 2014-81/CVE-2014-1585/CVE-2014-1586 (bmo#1062876, bmo#1062981) Inconsistent video sharing within iframe

- MFSA 2014-82/CVE-2014-1583 (bmo#1015540) Accessing cross-origin objects via the Alarms API

- SSLv3 is disabled by default. See README.POODLE for more detailed information.

- disable call home features

- update to 3.17.2 (bnc#900941) Bugfix release

- bmo#1049435 - Importing an RSA private key fails if p < q

- bmo#1057161 - NSS hangs with 100% CPU on invalid EC key

- bmo#1078669 - certutil crashes when using the
--certVersion parameter

- changes from earlier version of the 3.17 branch: update to 3.17.1 (bnc#897890)

- MFSA 2014-73/CVE-2014-1568 (bmo#1064636, bmo#1069405) RSA Signature Forgery in NSS

- Change library's signature algorithm default to SHA256

- Add support for draft-ietf-tls-downgrade-scsv

- Add clang-cl support to the NSS build system

- Implement TLS 1.3 :

- Part 1. Negotiate TLS 1.3

- Part 2. Remove deprecated cipher suites andcompression.

- Add support for little-endian powerpc64 update to 3.17

- required for Firefox 33 New functionality :

- When using ECDHE, the TLS server code may be configured to generate a fresh ephemeral ECDH key for each handshake, by setting the SSL_REUSE_SERVER_ECDHE_KEY socket option to PR_FALSE. The SSL_REUSE_SERVER_ECDHE_KEY option defaults to PR_TRUE, which means the server's ephemeral ECDH key is reused for multiple handshakes. This option does not affect the TLS client code, which always generates a fresh ephemeral ECDH key for each handshake. New Macros


- The manual pages for the certutil and pp tools have been updated to document the new parameters that had been added in NSS 3.16.2.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.


To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Software Development Kit 12 :

zypper in -t patch SUSE-SLE-SDK-12-2014-81

SUSE Linux Enterprise Server 12 :

zypper in -t patch SUSE-SLE-SERVER-12-2014-81

SUSE Linux Enterprise Desktop 12 :

zypper in -t patch SUSE-SLE-DESKTOP-12-2014-81

To bring your system up-to-date, use 'zypper patch'.

See Also

Plugin Details

Severity: High

ID: 83849

File Name: suse_SU-2014-1510-1.nasl

Version: 2.11

Type: local

Agent: unix

Published: 2015/05/27

Updated: 2021/01/19

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 5.9

CVSS v2.0

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:MozillaFirefox, p-cpe:/a:novell:suse_linux:MozillaFirefox-branding-SLE, p-cpe:/a:novell:suse_linux:MozillaFirefox-debuginfo, p-cpe:/a:novell:suse_linux:MozillaFirefox-debugsource, p-cpe:/a:novell:suse_linux:MozillaFirefox-translations, p-cpe:/a:novell:suse_linux:libfreebl3, p-cpe:/a:novell:suse_linux:libfreebl3-debuginfo, p-cpe:/a:novell:suse_linux:libfreebl3-hmac, p-cpe:/a:novell:suse_linux:libsoftokn3, p-cpe:/a:novell:suse_linux:libsoftokn3-debuginfo, p-cpe:/a:novell:suse_linux:libsoftokn3-hmac, p-cpe:/a:novell:suse_linux:mozilla-nss, p-cpe:/a:novell:suse_linux:mozilla-nss-certs, p-cpe:/a:novell:suse_linux:mozilla-nss-certs-debuginfo, p-cpe:/a:novell:suse_linux:mozilla-nss-debuginfo, p-cpe:/a:novell:suse_linux:mozilla-nss-debugsource, p-cpe:/a:novell:suse_linux:mozilla-nss-tools, p-cpe:/a:novell:suse_linux:mozilla-nss-tools-debuginfo, cpe:/o:novell:suse_linux:12

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/11/27

Vulnerability Publication Date: 2014/09/25

Reference Information

CVE: CVE-2014-1568, CVE-2014-1574, CVE-2014-1575, CVE-2014-1576, CVE-2014-1577, CVE-2014-1578, CVE-2014-1581, CVE-2014-1583, CVE-2014-1585, CVE-2014-1586

BID: 70116, 70424, 70425, 70426, 70427, 70428, 70430, 70436, 70439, 70440, 72178