7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
0.101 Low
EPSS
Percentile
94.9%
Updated nspr and nss packages fix security vulnerabilities: Potentially exploitable buffer overflow in NSS before 3.15.3 that allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets (CVE-2013-5605). The CERT_VerifyCert function in lib/certhigh/certvfy.c in NSS before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate (CVE-2013-5606). Runaway memset due to an integer truncation in certificate parsing on 64-bit computers in NSS before 3.15.3 leading to a crash by attempting to write 4Gb of nulls (CVE-2013-1741). Integer overflow in NSPR before 4.10.2 due to unsigned integer wrapping in PL_ArenaAllocate (CVE-2013-5607). NSS lowered the priority of RC4 in cipher suite advertisement so that more secure ciphers instead of RC4 are likely to be chosen by the server, because of plaintext recovery attacks possible with RC4 (CVE-2013-2566). This also updates to the latest root certificate data from Mozilla. Additionally, The latest Firefox ESR version, which fixes an issue with translated strings not being used in some cases, is also being provided.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Mageia | 2 | noarch | rootcerts | < 20131111.00-1 | rootcerts-20131111.00-1.mga2 |
Mageia | 2 | noarch | nspr | < 4.10.2-1 | nspr-4.10.2-1.mga2 |
Mageia | 2 | noarch | nss | < 3.15.3-1 | nss-3.15.3-1.mga2 |
Mageia | 2 | noarch | firefox | < 24.1.1-1 | firefox-24.1.1-1.mga2 |
Mageia | 2 | noarch | firefox-l10n | < 24.1.1-1 | firefox-l10n-24.1.1-1.mga2 |
Mageia | 3 | noarch | rootcerts | < 20131111.00-1 | rootcerts-20131111.00-1.mga3 |
Mageia | 3 | noarch | nspr | < 4.10.2-1 | nspr-4.10.2-1.mga3 |
Mageia | 3 | noarch | nss | < 3.15.3-1 | nss-3.15.3-1.mga3 |
Mageia | 3 | noarch | firefox | < 24.1.1-1 | firefox-24.1.1-1.mga3 |
Mageia | 3 | noarch | firefox-l10n | < 24.1.1-1 | firefox-l10n-24.1.1-1.mga3 |
www.mozilla.org/security/announce/2013/mfsa2013-103.html
bugs.mageia.org/show_bug.cgi?id=11669
bugzilla.mozilla.org/show_bug.cgi?id=932310
developer.mozilla.org/en-US/docs/NSS/NSS_3.15.3_release_notes
groups.google.com/forum/#!topic/mozilla.dev.tech.nspr/_8AcygMEjSA
www.mozilla.org/en-US/firefox/24.1.1/releasenotes/
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
5.9 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
0.101 Low
EPSS
Percentile
94.9%