The remote OracleVM system is missing necessary patches to address critical security updates :

nss

  - Added nss-vendor.patch to change vendor

  - Replace expired PayPal test certificate that breaks the     build

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Removed listed but unused patches detected by the     rpmdiff test

  - Resolves: Bug 1099619

  - Update some patches on account of the rebase

  - Resolves: Bug 1099619

  - Backport nss-3.12.6 upstream fix required by Firefox 31

  - Resolves: Bug 1099619

  - Remove two unused patches and apply a needed one that     was missed

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Update to nss-3.16.1

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Make pem's derEncodingsMatch function work with     encrypted keys

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Remove unused patches

  - Resolves: Bug 1048713

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Revoke trust in one mis-issued anssi certificate

  - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI     certificate (MFSA 2013-117) [rhel-6.6]

  - Enable patch with fix for deadlock in trust domain lock     and object lock

  - Resolves: Bug 1036477 - deadlock in trust domain lock     and object lock

  - Disable hw gcm on rhel-5 based build environments where     OS lacks support

  - Rollback changes to build nss without softokn until Bug     689919 is approved

  - Cipher suite was run as part of the nss-softokn build

  - Update to NSS_3_15_3_RTM

  - Resolves: Bug 1032470 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741)

  - Using export NSS_DISABLE_HW_GCM=1 to deal with some     problemmatic build systems

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add s390x and ia64 to the %define multilib_arches list     used for defining alt_ckbi

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add zero default value to DISABLETEST check and fix the     TEST_FAILURES check and reporting

  - Resolves: rhbz#990631 - file permissions of     pkcs11.txt/secmod.db must be kept when modified by NSS

  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for     FF 24.x)

  - Add a zero default value to the DISABLETEST and     TEST_FAILURES checks

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix the test for zero failures in the %check section

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Restore a mistakenly removed patch

  - Resolves: rhbz#961659 - SQL backend does not reload     certificates

  - Rebuild for the pem module to link with freel from     nss-softokn-3.14.3-6.el6

  - Related: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP     clients

  - Don't require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Additional syntax fixes in     nss-versus-softoken-test.patch

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix all.sh test for which application was last build by     updating nss-versus-softoken-test.path

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Disable the cipher suite already run as part of the     nss-softokn build

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Require nspr-4.10.0

  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for     FF 24.x)

  - Fix relative path in %check section to prevent     undetected test failures

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Rebase to NSS_3.15.1_RTM

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Update patches on account of the shallow tree with the     rebase to 3.15.1

  - Update the pem module sources nss-pem-20130405.tar.bz2     with latest patches applied

  - Remove patches rendered obsolete by the nss rebase and     the updated nss-pem sources

  - Enable the iquote.patch to access newly introduced types

  - Do not hold issuer certificate handles in the crl cache

  - Resolves: rhbz#961659 - SQL backend does not reload     certificates

  - Resolves: rhbz#977341 - nss-tools certutil -H does not     list all options

  - Resolves: rhbz#702083 - don't require unique file     basenames

  - Fix race condition in cert code related to smart cards

  - Resolves: rhbz#903017 - Firefox hang when CAC/PIV smart     card certificates are viewed in the certificate manager

  - Configure libnssckbi.so to use the alternatives system     in order to prepare for a drop in replacement. Please     ensure that older packages that don't use the     alternatives system for libnssckbi.so have a smaller     n-v-r.

  - Syncup with uptream changes for aes gcm and ecc suiteb

  - Enable ecc support for suite b

  - Apply several upstream AES GCM fixes

  - Use the pristine nss upstream sources with ecc included

  - Export NSS_ENABLE_ECC=1 in both the build and the check     sections

  - Make failed requests for unsupoprted ssl pkcs 11 bypass     non fatal

  - Resolves: rhbz#882408 - NSS_NO_PKCS11_BYPASS must     preserve ABI

  - Related: rhbz#918950 - rebase nss to 3.14.3

nss-softokn

  - Adjust patch to be compatible with legacy softokn API.

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Skip calls to CHECK_FORK in [C & NSC]_GetFunctionList

  - Resolves: Bug 1082900 - Admin server segfault when     configuration DS configured on SSL port

  - Add workaround to %check unset DISPLAY section for     RHEL-5 based build machines where kernel lacks support     for hardware GCM

  - back out -fips package changes

  - Enable new packaging but don't apply nss-fips-post.patch

  - Related: rhbz#1008513 - Unable to login in fips mode

  - Fix the PR_Access stub to actually access the correct     permissions

  - Resolves: rhbz#1008513 - Unable to login in fips mode

  - Run the lowhash tests

  - Require nspr-4.0.0 and nss-util-3.15.1

  - create -fips packages

  - patch submitted by Bob Relyea

  - fix the script that splits softoken off from nss

  - patch nss/cmd/lib/basicutil.c to build against     nss-util-3.15.1

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Resolves: rhbz#976572 - Pick up various upstream GCM     code fixes applied since nss-3.14.3 was released

  - Display cpuifo as part of the tests and make     NSS_DISABLE_HW_GCM the environment variable to test for

  - When appling the patches use a backup file suffix that     better describes the patch purpose

  - Enable ECC support for suite b and add upstream fixes     for aec gcm

  - Use the unstripped upstream sources with ecc support

  - Limit the ECC support to suite b

  - Apply several upstream aes gcm fixes

  - Rename macros EC_MIN_KEY_BITS and EC_MAX_KEY_BITS per     upstream

  - Resolves: rhbz#960208 - Enable ECC in nss-softoken

  - Related: rhbz#919172

nss-util

  - Resolves: bug 1145431 - (CVE-2014-1568)

  - Update to nss-3.16.1

  - Resolves: rhbz#1112136

  - Update to NSS_3_15_3_RTM

  - Resolves: rhbz#1032470 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741)

  - Preserve existing permissions when replacing existing     pkcs11.txt file, but keep strict default permissions for     new files

  - Resolves: rhbz#990631 - file permissions of     pkcs11.txt/secmod.db must be kept when modified by NSS

The installed version of Thunderbird is earlier than 24.1.1 and is, therefore, potentially affected the following vulnerabilities:

  - An error exists related to handling input greater than     half the maximum size of the 'PRUint32' value.
    (CVE-2013-1741)

  - An error exists in the 'Null_Cipher' function in the     file 'ssl/ssl3con.c' related to handling invalid     handshake packets that could allow arbitrary code     execution. (CVE-2013-5605)

  - An error exists in the 'CERT_VerifyCert' function in     the file 'lib/certhigh/certvfy.c' that could allow     invalid certificates to be treated as valid.
    (CVE-2013-5606)

  - An integer truncation error exists in the function     'PL_ArenaAllocate' in the Netscape Portable Runtime     (NSPR) library. (CVE-2013-5607)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Added nss-vendor.patch to change vendor

  - Update some patches on account of the rebase

  - Resolves: Bug 1099619

  - Backport nss-3.12.6 upstream fix required by Firefox 31

  - Resolves: Bug 1099619

  - Remove two unused patches and apply a needed one that     was missed

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Update to nss-3.16.1

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Make pem's derEncodingsMatch function work with     encrypted keys

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Remove unused patches

  - Resolves: Bug 1048713

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Revoke trust in one mis-issued anssi certificate

  - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI     certificate (MFSA 2013-117) [rhel-6.6]

  - Enable patch with fix for deadlock in trust domain lock     and object lock

  - Resolves: Bug 1036477 - deadlock in trust domain lock     and object lock

  - Disable hw gcm on rhel-5 based build environments where     OS lacks support

  - Rollback changes to build nss without softokn until Bug     689919 is approved

  - Cipher suite was run as part of the nss-softokn build

  - Update to NSS_3_15_3_RTM

  - Resolves: Bug 1032470 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741)

  - Using export NSS_DISABLE_HW_GCM=1 to deal with some     problemmatic build systems

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add s390x and ia64 to the %define multilib_arches list     used for defining alt_ckbi

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add zero default value to DISABLETEST check and fix the     TEST_FAILURES check and reporting

  - Resolves: rhbz#990631 - file permissions of     pkcs11.txt/secmod.db must be kept when modified by NSS

  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for     FF 24.x)

  - Add a zero default value to the DISABLETEST and     TEST_FAILURES checks

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix the test for zero failures in the %check section

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Restore a mistakenly removed patch

  - Resolves: rhbz#961659 - SQL backend does not reload     certificates

  - Rebuild for the pem module to link with freel from     nss-softokn-3.14.3-6.el6

  - Related: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP     clients

  - Don't require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Additional syntax fixes in     nss-versus-softoken-test.patch

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix all.sh test for which application was last build by     updating nss-versus-softoken-test.path

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Disable the cipher suite already run as part of the     nss-softokn build

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard.

The installed version of Firefox ESR 24.x is a version prior to 24.1.1, and is, therefore, potentially affected by the following vulnerabilities :

  - An error exists related to handling input greater than     half the maximum size of the 'PRUint32' value.
    (CVE-2013-1741)

  - An error exists in the 'Null_Cipher' function in the     file 'ssl/ssl3con.c' related to handling invalid     handshake packets that could allow arbitrary code     execution. (CVE-2013-5605)

  - An error exists in the 'CERT_VerifyCert' function in     the file 'lib/certhigh/certvfy.c' that could allow     invalid certificates to be treated as valid.
    (CVE-2013-5606)

  - An integer truncation error exists in the function     'PL_ArenaAllocate' in the Netscape Portable Runtime     (NSPR) library. (CVE-2013-5607)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has nss packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way NSS responded to an     SSLv2-compatible ClientHello with a ServerHello that had     an all-zero random. A man-in-the-middle attacker could     use this flaw in a passive replay attack.
    (CVE-2018-12384)

  - The TLS implementation in Mozilla Network Security     Services (NSS) does not properly consider timing side-     channel attacks on a noncompliant MAC check operation     during the processing of malformed CBC padding, which     allows remote attackers to conduct distinguishing     attacks and plaintext-recovery attacks via statistical     analysis of timing data for crafted packets, a related     issue to CVE-2013-0169. (CVE-2013-1620)

  - Mozilla Network Security Services (NSS) before 3.15.2     does not ensure that data structures are initialized     before read operations, which allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via vectors that trigger a decryption     failure. (CVE-2013-1739)

  - A flaw was found in the way TLS False Start was     implemented in NSS. An attacker could use this flaw to     potentially return unencrypted information from the     server. (CVE-2013-1740)

  - Integer overflow in Mozilla Network Security Services     (NSS) 3.15 before 3.15.3 allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via a large size value. (CVE-2013-1741)

  - Mozilla Network Security Services (NSS) 3.14 before     3.14.5 and 3.15 before 3.15.3 allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via invalid handshake packets.
    (CVE-2013-5605)

  - The CERT_VerifyCert function in lib/certhigh/certvfy.c     in Mozilla Network Security Services (NSS) 3.15 before     3.15.3 provides an unexpected return value for an     incompatible key-usage certificate when the     CERTVerifyLog argument is valid, which might allow     remote attackers to bypass intended access restrictions     via a crafted certificate. (CVE-2013-5606)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Mozilla NSPR and NSS were updated to fix various security bugs that could be used to crash the browser or potentially execute code.

Mozilla NSPR 4.10.2 has the following bug fixes :

  - Bug 770534: Possible pointer overflow in     PL_ArenaAllocate(). Fixed by Pascal Cuoq and Kamil     Dudka.

  - Bug 888546: ptio.c:PR_ImportUDPSocket doesn't work.
    Fixed by Miloslav Trmac.

  - Bug 915522: VS2013 support for NSPR. Fixed by Makoto     Kato.

  - Bug 927687: Avoid unsigned integer wrapping in     PL_ArenaAllocate. (CVE-2013-5607) Mozilla NSS 3.15.3 is     a patch release for NSS 3.15 and includes the following     bug fixes :

  - Bug 925100: Ensure a size is <= half of the maximum     PRUint32 value. (CVE-2013-1741)

  - Bug 934016: Handle invalid handshake packets.
    (CVE-2013-5605)

  - Bug 910438: Return the correct result in CERT_VerifyCert     on failure, if a verifyLog isn't used. (CVE-2013-5606)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1791 advisory.

    - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]
    - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]
    - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605)

It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739)

An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607)

It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate.
(CVE-2013-5606)

Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607.

In addition, the nss package has been upgraded to upstream version 3.15.3, and the nspr package has been upgraded to upstream version 4.10.2. These updates provide a number of bug fixes and enhancements over the previous versions. (BZ#1033478, BZ#1020520)

This update also fixes the following bug :

* The RHBA-2013:1318 update introduced a regression that prevented the use of certificates that have an MD5 signature. This update fixes this regression and certificates that have an MD5 signature are once again supported. To prevent the use of certificates that have an MD5 signature, set the 'NSS_HASH_ALG_SUPPORT' environment variable to '-MD5'. (BZ#1033499)

Users of NSS and NSPR are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.

Updated nss, nspr, and nss-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605)

It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739)

An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607)

It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate.
(CVE-2013-5606)

Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607.

All NSS, NSPR, and nss-util users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, applications using NSS, NSPR, or nss-util must be restarted for this update to take effect.

Multiple security issues was identified and fixed in mozilla NSPR and NSS :

Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure (CVE-2013-1739).

Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large size value (CVE-2013-1741).

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext (CVE-2013-2566).

Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets (CVE-2013-5605).

The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate (CVE-2013-5606).

Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741 (CVE-2013-5607).

The NSPR packages has been upgraded to the 4.10.2 version and the NSS packages has been upgraded to the 3.15.3 version which is unaffected by these security flaws.

Additionally the rootcerts packages has been upgraded with the latest certdata.txt file as of 2013/11/11 from mozilla.

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, potentially execute arbitrary code, or lead to information disclosure. (CVE-2013-1741, CVE-2013-2566, CVE-2013-5605, CVE-2013-5607).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
79540	OracleVM 3.3 : nss (OVMSA-2014-0023)	Nessus	OracleVM Local Security Checks	11/26/2014	1/4/2021	high
71045	Mozilla Thunderbird < 24.1.1 NSS and NSPR Multiple Vulnerabilities	Nessus	Windows	11/22/2013	11/27/2019	high
79537	OracleVM 3.3 : nss (OVMSA-2014-0014)	Nessus	OracleVM Local Security Checks	11/26/2014	1/4/2021	high
70948	Firefox ESR 24.x < 24.1.1 NSS and NSPR Multiple Vulnerabilities	Nessus	Windows	11/18/2013	6/23/2026	high
127200	NewStart CGSL CORE 5.04 / MAIN 5.04 : nss Multiple Vulnerabilities (NS-SA-2019-0033)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	11/20/2025	medium
71172	SuSE 11.2 / 11.3 Security Update : mozilla-nspr, mozilla-nss (SAT Patch Numbers 8572 / 8573)	Nessus	SuSE Local Security Checks	12/3/2013	1/19/2021	high
71241	Oracle Linux 5 : nss / and / nspr (ELSA-2013-1791)	Nessus	Oracle Linux Local Security Checks	12/6/2013	4/29/2025	critical
71243	RHEL 5 : nss and nspr (RHSA-2013:1791)	Nessus	Red Hat Local Security Checks	12/6/2013	1/14/2021	high
71390	RHEL 6 : nss, nspr, and nss-util (RHSA-2013:1829)	Nessus	Red Hat Local Security Checks	12/13/2013	1/14/2021	high
70998	Mandriva Linux Security Advisory : nss (MDVSA-2013:270)	Nessus	Mandriva Local Security Checks	11/21/2013	1/6/2021	high
71021	Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : firefox vulnerabilities (USN-2031-1)	Nessus	Ubuntu Local Security Checks	11/21/2013	9/19/2019	medium

Detections

Analytics

Plugins Search

high

high

high

high

medium

high

critical

high

high

high

medium