An update for nss and nspr is now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

The following packages have been upgraded to a newer upstream version:
nss 3.21.0, nspr 4.11.0. (BZ#1297944, BZ#1297943)

Security Fix(es) :

* A use-after-free flaw was found in the way NSS handled DHE (Diffie-Hellman key exchange) and ECDHE (Elliptic Curve Diffie-Hellman key exchange) handshake messages. A remote attacker could send a specially crafted handshake message that, when parsed by an application linked against NSS, would cause that application to crash or, under certain special conditions, execute arbitrary code using the permissions of the user running the application. (CVE-2016-1978)

* A use-after-free flaw was found in the way NSS processed certain DER (Distinguished Encoding Rules) encoded cryptographic keys. An attacker could use this flaw to create a specially crafted DER encoded certificate which, when parsed by an application compiled against the NSS library, could cause that application to crash, or execute arbitrary code using the permissions of the user running the application. (CVE-2016-1979)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Eric Rescorla as the original reporter of CVE-2016-1978; and Tim Taubert as the original reporter of CVE-2016-1979.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0684 advisory.

    nspr     [4.11.0-0.1]
    - Rebase to NSPR 4.11
    - Resolves: Bug 1297943 - Rebase RHEL 5.11.z to NSPR 4.11 in preparation for Firefox 45

    nss     [3.21.0-6]
    - Fix SSL_DH_MIN_P_BITS in more places.

    [3.21.0-5]
    - Keep SSL_DH_MIN_P_BITS at 768 as in the previously released build.

    [3.21.0-4]
    - Run SSL tests

    [3.21.0-3]
    - Add compatility patches to prevent regressions

    [3.21.0-2]
    - Ensure all ssl.sh tests are executed

    [3.21.0-1]
    - Rebase to nss 3.21
    - Resolves: Bug 1297944 - Rebase RHEL 5.11.z to NSS 3.21 in preparation for Firefox 45

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2973-1 advisory.

    Christian Holler, Tyson Smith, and Phil Ringalda discovered multiple memory safety issues in Thunderbird.
    If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit     these to cause a denial of service via application crash, or execute arbitrary code. (CVE-2016-2805,     CVE-2016-2807)

    Hanno Bck discovered that calculations with mp_div and mp_exptmod in NSS produce incorrect results in     some circumstances, resulting in cryptographic weaknesses. (CVE-2016-1938)

    A use-after-free was discovered in ssl3_HandleECDHServerKeyExchange in NSS. A remote attacker could     potentially exploit this to cause a denial of service via application crash, or execute arbitrary code.
    (CVE-2016-1978)

    A use-after-free was discovered in PK11_ImportDERPrivateKeyInfoAndReturnKey in NSS. A remote attacker     could potentially exploit this to cause a denial of service via application crash, or execute arbitrary     code. (CVE-2016-1979)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for MozillaFirefox, mozilla-nspr, mozilla-nss fixes the following issues :

Mozilla Firefox was updated to 38.7.0 ESR (bsc#969894), fixing following security issues :

  - MFSA 2016-16/CVE-2016-1952/CVE-2016-1953 Miscellaneous     memory safety hazards (rv:45.0 / rv:38.7)

  - MFSA 2016-17/CVE-2016-1954 Local file overwriting and     potential privilege escalation through CSP reports

  - MFSA 2016-20/CVE-2016-1957 Memory leak in libstagefright     when deleting an array during MP4 processing

  - MFSA 2016-21/CVE-2016-1958 Displayed page address can be     overridden

  - MFSA 2016-23/CVE-2016-1960 Use-after-free in HTML5     string parser

  - MFSA 2016-24/CVE-2016-1961 Use-after-free in SetBody

  - MFSA 2016-25/CVE-2016-1962 Use-after-free when using     multiple WebRTC data channels

  - MFSA 2016-27/CVE-2016-1964 Use-after-free during XML     transformations

  - MFSA 2016-28/CVE-2016-1965 Addressbar spoofing though     history navigation and Location protocol property

  - MFSA 2016-31/CVE-2016-1966 Memory corruption with     malicious NPAPI plugin

  - MFSA 2016-34/CVE-2016-1974 Out-of-bounds read in HTML     parser following a failed allocation

  - MFSA 2016-35/CVE-2016-1950 Buffer overflow during ASN.1     decoding in NSS

  - MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/     CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/     CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/     CVE-2016-2800/CVE-2016-2801/CVE-2016-2802 Font     vulnerabilities in the Graphite 2 library

Mozilla NSPR was updated to version 4.12 (bsc#969894), fixing following bugs :

  - added a PR_GetEnvSecure function, which attempts to     detect if the program is being executed with elevated     privileges, and returns NULL if detected. It is     recommended to use this function in general purpose     library code.

  - fixed a memory allocation bug related to the PR_*printf     functions

  - exported API PR_DuplicateEnvironment, which had already     been added in NSPR 4.10.9

  - added support for FreeBSD aarch64

  - several minor correctness and compatibility fixes

Mozilla NSS was updated to fix security issues (bsc#969894) :

  - MFSA 2016-15/CVE-2016-1978 Use-after-free in NSS during     SSL connections in low memory

  - MFSA 2016-35/CVE-2016-1950 Buffer overflow during ASN.1     decoding in NSS

  - MFSA 2016-36/CVE-2016-1979 Use-after-free during     processing of DER encoded keys in NSS

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
90721	CentOS 5 : nspr / nss (CESA-2016:0684)	Nessus	CentOS Local Security Checks	4/27/2016	1/4/2021	high
90745	Oracle Linux 5 : nss / and / nspr (ELSA-2016-0684)	Nessus	Oracle Linux Local Security Checks	4/27/2016	10/22/2024	high
90748	RHEL 5 : nss and nspr (RHSA-2016:0684)	Nessus	Red Hat Local Security Checks	4/27/2016	10/24/2019	high
91258	Ubuntu 14.04 LTS / 16.04 LTS : Thunderbird vulnerabilities (USN-2973-1)	Nessus	Ubuntu Local Security Checks	5/19/2016	8/27/2024	high
90263	SUSE SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2016:0909-1)	Nessus	SuSE Local Security Checks	4/1/2016	1/19/2021	critical

Detections

Analytics

Plugins Search

high

high

high

high

critical