This update for mozilla-nspr, mozilla-nss fixes the following issues :

mozilla-nss was updated to version 3.53.1

CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032).

CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978).

CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).

Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).

Fixed an issue where Firefox tab was crashing (bsc#1170908).

Release notes:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53
_rele ase_notes

mozilla-nspr to version 4.25

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4421-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, obtain sensitive information, or execute arbtirary code. (CVE-2020-12405, CVE-2020-12406,     CVE-2020-12410, CVE-2020-12417, CVE-2020-12418, CVE-2020-12419, CVE-2020-12420)

    It was discovered that Thunderbird would continue an unencrypted connection when configured to use     STARTTLS for IMAP if the server responded with PREAUTH. A remote attacker could potentially exploit this     to perform a person-in-the-middle attack in order to obtain sensitive information. (CVE-2020-12398)

    It was discovered that NSS showed timing differences when performing DSA signatures. An attacker could     potentially exploit this to obtain private keys using a timing attack. (CVE-2020-12399)

    It was discovered that when performing add-on updates, certificate chains not terminating with built-in     roots were silently rejected. This could result in add-ons becoming outdated. (CVE-2020-12421)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for mozilla-nspr, mozilla-nss fixes the following issues :

mozilla-nss was updated to version 3.53

  - CVE-2020-12399: Fixed a timing attack on DSA signature     generation (bsc#1171978).

  - CVE-2019-17006: Added length checks for cryptographic     primitives (bsc#1159819). Release notes:
    https://developer.mozilla.org/en-US/docs/Mozilla/Project     s/NSS/NSS_3.53_release_notes

mozilla-nspr to version 4.25

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-202007-49 (Mozilla Network Security Service (NSS): Information disclosure)

    NSS was found to not always perform constant-time operations when       working with DSA key material.
  Impact :

    An attacker may be able to obtain information about a DSA private key.
  Workaround :

    There is no known workaround at this time.

Various vulnerabilities were fixed in nss, the Network Security Service libraries.

CVE-2018-12404

Cache side-channel variant of the Bleichenbacher attack.

CVE-2018-18508

NULL pointer dereference in several CMS functions resulting in a denial of service.

CVE-2019-11719

Out-of-bounds read when importing curve25519 private key.

CVE-2019-11729

Empty or malformed p256-ECDH public keys may trigger a segmentation fault.

CVE-2019-11745

Out-of-bounds write when encrypting with a block cipher.

CVE-2019-17006

Some cryptographic primitives did not check the length of the input text, potentially resulting in overflows.

CVE-2019-17007

Handling of Netscape Certificate Sequences may crash with a NULL dereference leading to a denial of service.

CVE-2020-12399

Force a fixed length for DSA exponentiation.

CVE-2020-6829 CVE-2020-12400

Side channel attack on ECDSA signature generation.

CVE-2020-12401

ECDSA timing attack mitigation bypass.

CVE-2020-12402

Side channel vulnerabilities during RSA key generation.

CVE-2020-12403

CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read.

For Debian 9 stretch, these problems have been fixed in version 2:3.26.2-1.1+deb9u2.

We recommend that you upgrade your nss packages.

For the detailed security status of nss please refer to its security tracker page at: https://security-tracker.debian.org/tracker/nss

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_3280 advisory.

    * nss: UAF in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

    * nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

    * nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402)

    * nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 68.9. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-21 advisory.

  - Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 76 and     Firefox ESR 68.8. Some of these bugs showed evidence of memory corruption and we presume that with enough     effort some of these could have been exploited to run arbitrary code. (CVE-2020-12410)

  - NSS has shown timing differences when performing DSA signatures, which was exploitable and could     eventually leak private keys. (CVE-2020-12399)

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

  - Mozilla developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2020-12406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or a timing attack on cryptographic keys.

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code or a timing attack on cryptographic keys.

For Debian 8 'Jessie', these problems have been fixed in version 68.9.0esr-1~deb8u2.

NOTE: 68.9.0esr-1~deb8u2 fixes an i386 build error in the otherwise identical 68.9.0esr-1~deb8u1 that was uploaded but not announced.

We recommend that you upgrade your firefox-esr packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4397-1 advisory.

    It was discovered that NSS incorrectly handled the TLS State Machine. A remote attacker could possibly use     this issue to cause NSS to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04     LTS and Ubuntu 19.10. (CVE-2019-17023)

    Cesar Pereida Garcia discovered that NSS incorrectly handled DSA key generation. A local attacker could     possibly use this issue to perform a timing attack and recover DSA keys. (CVE-2020-12399)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NSS has shown timing differences when performing DSA     signatures, which was exploitable and could eventually     leak private keys. This vulnerability affects     Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR <     68.9.(CVE-2020-12399)

  - When converting coordinates from projective to affine,     the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel     attack. This vulnerability affects Firefox < 80 and     Firefox for Android < 80.(CVE-2020-12400)

  - A flaw was found in the way CHACHA20-POLY1305 was     implemented in NSS. When using multi-part Chacha20, it     could cause out-of-bounds reads. This issue was fixed     by explicitly disabling multi-part ChaCha20 (which was     not functioning correctly) and strictly enforcing tag     length. The highest threat from(CVE-2020-12403)

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
138314	SUSE SLES12 Security Update : mozilla-nspr, mozilla-nss (SUSE-SU-2020:1839-1)	Nessus	SuSE Local Security Checks	2020/7/9	2024/3/1	critical
138326	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Thunderbird vulnerabilities (USN-4421-1)	Nessus	Ubuntu Local Security Checks	2020/7/9	2024/8/27	high
138700	openSUSE Security Update : mozilla-nspr / mozilla-nss (openSUSE-2020-854)	Nessus	SuSE Local Security Checks	2020/7/20	2024/2/29	critical
138972	GLSA-202007-49 : Mozilla Network Security Service (NSS): Information disclosure	Nessus	Gentoo Local Security Checks	2020/7/27	2020/9/24	medium
141062	Debian DLA-2388-1 : nss security update	Nessus	Debian Local Security Checks	2020/9/30	2024/2/16	critical
359300	Rocky Linux 8 [CIQ] Security Update: nspr / nspr-debuginfo / nspr-debugsource / nspr-devel Multiple Vulnerabilities (crlsa-2020_3280)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
137051	Mozilla Firefox ESR < 68.9	Nessus	Windows	2020/6/2	2025/11/18	high
137155	Debian DSA-4695-1 : firefox-esr - security update	Nessus	Debian Local Security Checks	2020/6/5	2024/3/7	high
137284	Debian DLA-2243-1 : firefox-esr security update	Nessus	Debian Local Security Checks	2020/6/10	2024/3/7	high
137555	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : NSS vulnerabilities (USN-4397-1)	Nessus	Ubuntu Local Security Checks	2020/6/17	2025/9/3	medium
143400	EulerOS 2.0 SP9 : nss (EulerOS-SA-2020-2487)	Nessus	Huawei Local Security Checks	2020/12/1	2024/2/7	critical

检测

插件搜索

critical

high

critical

medium

critical

critical

high

high

high

medium

critical