Mozilla Foundation reports :

Security researcher Hanno Bock reported that calculations with mp_div and mp_exptmod in Network Security Services (NSS) can produce wrong results in some circumstances. These functions are used within NSS for a variety of cryptographic division functions, leading to potential cryptographic weaknesses.

Mozilla developer Eric Rescorla reported that a failed allocation during DHE and ECDHE handshakes would lead to a use-after-free vulnerability.

Mozilla Firefox was updated to 38.7.0 ESR, fixing the following security issues :

MFSA 2016-16/CVE-2016-1952/CVE-2016-1953: Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)

MFSA 2016-17/CVE-2016-1954: Local file overwriting and potential privilege escalation through CSP reports

MFSA 2016-20/CVE-2016-1957: Memory leak in libstagefright when deleting an array during MP4 processing

MFSA 2016-21/CVE-2016-1958: Displayed page address can be overridden

MFSA 2016-23/CVE-2016-1960: Use-after-free in HTML5 string parser

MFSA 2016-24/CVE-2016-1961: Use-after-free in SetBody

MFSA 2016-25/CVE-2016-1962: Use-after-free when using multiple WebRTC data channels

MFSA 2016-27/CVE-2016-1964: Use-after-free during XML transformations

MFSA 2016-28/CVE-2016-1965: Addressbar spoofing though history navigation and Location protocol property

MFSA 2016-31/CVE-2016-1966: Memory corruption with malicious NPAPI plugin

MFSA 2016-34/CVE-2016-1974: Out-of-bounds read in HTML parser following a failed allocation

MFSA 2016-35/CVE-2016-1950: Buffer overflow during ASN.1 decoding in NSS

MFSA 2016-37/CVE-2016-1977/CVE-2016-2790/CVE-2016-2791/ CVE-2016-2792/CVE-2016-2793/CVE-2016-2794/CVE-2016-2795/ CVE-2016-2796/CVE-2016-2797/CVE-2016-2798/CVE-2016-2799/ CVE-2016-2800/CVE-2016-2801/CVE-2016-2802: Font vulnerabilities in the Graphite 2 library.

Mozilla NSPR was updated to version 4.12, fixing following bugs :

Added a PR_GetEnvSecure function, which attempts to detect if the program is being executed with elevated privileges, and returns NULL if detected. It is recommended to use this function in general purpose library code.

Fixed a memory allocation bug related to the PR_*printf functions

Exported API PR_DuplicateEnvironment, which had already been added in NSPR 4.10.9

Several minor correctness and compatibility fixes.

Mozilla NSS was updated to fix security issues :

MFSA 2016-15/CVE-2016-1978: Use-after-free in NSS during SSL connections in low memory

MFSA 2016-35/CVE-2016-1950: Buffer overflow during ASN.1 decoding in NSS

MFSA 2016-36/CVE-2016-1979: Use-after-free during processing of DER encoded keys in NSS.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0591 advisory.

    nspr     [4.11.0-0.1]
    - Rebase to NSPR 4.11

    nss     [3.21.0-0.3.0.1]
    - Added nss-vendor.patch to change vendor

    [3.21.0-0.3]
    - Ensure all ssl.sh tests are executed

    [3.21.0-0.2]
    - Ensure abi compatibility

    [3.21.0-0.1]
    - Rebase to NSS-3.21

    nss-util     [3.21.0-0.3]
    - Rebase RHEL 6.7.z to NSS-util 3.21 in preparation for Firefox 45
    - Resolves: Bug 1299874
    - Update upstream patch for CVE-2016-1950

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for nss, nspr, nss-softokn, and nss-util is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. The nss-util packages provide utilities for use with the Network Security Services (NSS) libraries. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

The following packages have been upgraded to a newer upstream version:
nss (3.21.0), nss-util (3.21.0), nspr (4.11.0). (BZ#1310581, BZ#1303021, BZ# 1299872)

Security Fix(es) :

* A use-after-free flaw was found in the way NSS handled DHE (Diffie-Hellman key exchange) and ECDHE (Elliptic Curve Diffie-Hellman key exchange) handshake messages. A remote attacker could send a specially crafted handshake message that, when parsed by an application linked against NSS, would cause that application to crash or, under certain special conditions, execute arbitrary code using the permissions of the user running the application.
(CVE-2016-1978)

* A use-after-free flaw was found in the way NSS processed certain DER (Distinguished Encoding Rules) encoded cryptographic keys. An attacker could use this flaw to create a specially crafted DER encoded certificate which, when parsed by an application compiled against the NSS library, could cause that application to crash, or execute arbitrary code using the permissions of the user running the application. (CVE-2016-1979)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Eric Rescorla as the original reporter of CVE-2016-1978; and Tim Taubert as the original reporter of CVE-2016-1979.

Bug Fix(es) :

* The nss-softokn package has been updated to be compatible with NSS 3.21. (BZ#1326221)

The following packages have been upgraded to a newer upstream version:
nss 3.21.0, nspr 4.11.0.

Security Fix(es) :

  - A use-after-free flaw was found in the way NSS handled     DHE (Diffie- Hellman key exchange) and ECDHE (Elliptic     Curve Diffie-Hellman key exchange) handshake messages. A     remote attacker could send a specially crafted handshake     message that, when parsed by an application linked     against NSS, would cause that application to crash or,     under certain special conditions, execute arbitrary code     using the permissions of the user running the     application. (CVE-2016-1978)

  - A use-after-free flaw was found in the way NSS processed     certain DER (Distinguished Encoding Rules) encoded     cryptographic keys. An attacker could use this flaw to     create a specially crafted DER encoded certificate     which, when parsed by an application compiled against     the NSS library, could cause that application to crash,     or execute arbitrary code using the permissions of the     user running the application. (CVE-2016-1979)

ID	Name	Product	Family	Published	Updated	Severity
89766	FreeBSD : NSS -- multiple vulnerabilities (75091516-6f4b-4059-9884-6727023dc366)	Nessus	FreeBSD Local Security Checks	3/9/2016	1/4/2021	high
90065	SUSE SLES10 Security Update : MozillaFirefox (SUSE-SU-2016:0820-1)	Nessus	SuSE Local Security Checks	3/21/2016	1/6/2021	critical
90383	Oracle Linux 6 : nss, / nss-util, / and / nspr (ELSA-2016-0591)	Nessus	Oracle Linux Local Security Checks	4/7/2016	10/23/2024	high
90749	RHEL 7 : nss, nspr, nss-softokn, and nss-util (RHSA-2016:0685)	Nessus	Red Hat Local Security Checks	4/27/2016	10/24/2019	high
90752	Scientific Linux Security Update : nss and nspr on SL5.x i386/x86_64 (20160425)	Nessus	Scientific Linux Local Security Checks	4/27/2016	1/14/2021	high

Detections

Analytics

Plugins Search

high

critical

high

high

high