The remote OracleVM system is missing necessary patches to address critical security updates :

  - Rebase to NSPR 4.11

  - Resolves: Bug 1297943 - Rebase RHEL 5.11.z to NSPR 4.11     in preparation for Firefox 45

  - Resolves: Bug 1269359 - (CVE-2015-7183)

  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead     to crash (under ASAN), potential memory corruption     [rhel-5.11.z]

  - Rebase to nspr-4.10.8

  - Resolves: Bug 1200921 - Rebase nspr to 4.10.8 for     Firefox 38 ESR 

  - Rebase to nspr-4.10.6

  - Resolves: Bug 1110857 - Rebase nspr in RHEL 5.11 to NSPR     4.10.6 for FF31

  - Retagging

  - Resolves: rhbz#1032468

  - Remove an unused patch

  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741) nss: various flaws [rhel-5.11]

  - Update to nspr-4.10.2

  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741) nss: various flaws [rhel-5.11]

  - Retagging to fix an inconsitency in the release tags

  - Resolves: rhbz#1002641 - Rebase RHEL 5 to NSPR 4.10 (for     FF 24.x)

  - Rebase to nspr-4.10.0

  - Resolves: rhbz#1002641 - Rebase RHEL 5 to NSPR 4.10 (for     FF 24.x)

  - Resolves: rhbz#737704 - Fix spec file test script typo     and enable running the test suites

  - Resolves: rhbz#919183 - Rebase to nspr-4.9.5

  - Resolves: rhbz#883777- [RFE] Rebase nspr to 4.9.2 due to     Firefox 17 ESR

  - Resolves: rhbz#633519 - pthread_key_t leak and memory     corruption

  - Resolves: rhbz#831654 - Fix %post and %postun

  - Updated License: to MPLv2.0 per upstream

  - Resolves: rhbz#831654 - Pick up fixes from the rhel-5.8     branch

  - Regenerated nspr-config-pc.patch passes the the rpmdiff     tests

  - Resolves: rhbz#831654 - restore top section of     nspr-config-pc.patch

  - Needed to prevent multilib regressions

  - Resolves: rhbz#831654 - revert unwanted changes to     nspr.pc

  - Change@/nspr4 to@ in the patch

  - Update to NSPR_4_9_1_RTM

  - Resolves: rhbz#831654

  - rebuilt

  - Resolves: Bug 772945 - [RFE] Async update nspr to make     firefox 10 LTS rebase possible

  - Update to 4.8.9

  - Bumping the relase tag so it's higher than the one in     5.7-z

  - Update to 4.8.8

The remote OracleVM system is missing necessary patches to address critical security updates :

nss

  - Added nss-vendor.patch to change vendor

  - Replace expired PayPal test certificate that breaks the     build

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Removed listed but unused patches detected by the     rpmdiff test

  - Resolves: Bug 1099619

  - Update some patches on account of the rebase

  - Resolves: Bug 1099619

  - Backport nss-3.12.6 upstream fix required by Firefox 31

  - Resolves: Bug 1099619

  - Remove two unused patches and apply a needed one that     was missed

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Update to nss-3.16.1

  - Resolves: Bug 1112136 - Rebase nss in RHEL 6.5.Z to NSS     3.16.1

  - Make pem's derEncodingsMatch function work with     encrypted keys

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Remove unused patches

  - Resolves: Bug 1048713

  - Resolves: Bug 1048713 - [PEM] active FTPS with encrypted     client key ends up with     SSL_ERROR_TOKEN_INSERTION_REMOVAL

  - Revoke trust in one mis-issued anssi certificate

  - Resolves: Bug 1042685 - nss: Mis-issued ANSSI/DCSSI     certificate (MFSA 2013-117) [rhel-6.6]

  - Enable patch with fix for deadlock in trust domain lock     and object lock

  - Resolves: Bug 1036477 - deadlock in trust domain lock     and object lock

  - Disable hw gcm on rhel-5 based build environments where     OS lacks support

  - Rollback changes to build nss without softokn until Bug     689919 is approved

  - Cipher suite was run as part of the nss-softokn build

  - Update to NSS_3_15_3_RTM

  - Resolves: Bug 1032470 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741)

  - Using export NSS_DISABLE_HW_GCM=1 to deal with some     problemmatic build systems

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add s390x and ia64 to the %define multilib_arches list     used for defining alt_ckbi

  - Resolves: rhbz#1016044 - nss.s390: primary link for     libnssckbi.so must be /usr/lib64/libnssckbi.so

  - Add zero default value to DISABLETEST check and fix the     TEST_FAILURES check and reporting

  - Resolves: rhbz#990631 - file permissions of     pkcs11.txt/secmod.db must be kept when modified by NSS

  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for     FF 24.x)

  - Add a zero default value to the DISABLETEST and     TEST_FAILURES checks

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix the test for zero failures in the %check section

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Restore a mistakenly removed patch

  - Resolves: rhbz#961659 - SQL backend does not reload     certificates

  - Rebuild for the pem module to link with freel from     nss-softokn-3.14.3-6.el6

  - Related: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Related: rhbz#1010224 - NSS 3.15 breaks SSL in OpenLDAP     clients

  - Don't require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Additional syntax fixes in     nss-versus-softoken-test.patch

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Fix all.sh test for which application was last build by     updating nss-versus-softoken-test.path

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Disable the cipher suite already run as part of the     nss-softokn build

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Require nss-softokn-fips

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Require nspr-4.10.0

  - Related: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1 (for     FF 24.x)

  - Fix relative path in %check section to prevent     undetected test failures

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Rebase to NSS_3.15.1_RTM

  - Resolves: rhbz#1002645 - Rebase RHEL 6 to NSS 3.15.1     (for FF 24.x)

  - Update patches on account of the shallow tree with the     rebase to 3.15.1

  - Update the pem module sources nss-pem-20130405.tar.bz2     with latest patches applied

  - Remove patches rendered obsolete by the nss rebase and     the updated nss-pem sources

  - Enable the iquote.patch to access newly introduced types

  - Do not hold issuer certificate handles in the crl cache

  - Resolves: rhbz#961659 - SQL backend does not reload     certificates

  - Resolves: rhbz#977341 - nss-tools certutil -H does not     list all options

  - Resolves: rhbz#702083 - don't require unique file     basenames

  - Fix race condition in cert code related to smart cards

  - Resolves: rhbz#903017 - Firefox hang when CAC/PIV smart     card certificates are viewed in the certificate manager

  - Configure libnssckbi.so to use the alternatives system     in order to prepare for a drop in replacement. Please     ensure that older packages that don't use the     alternatives system for libnssckbi.so have a smaller     n-v-r.

  - Syncup with uptream changes for aes gcm and ecc suiteb

  - Enable ecc support for suite b

  - Apply several upstream AES GCM fixes

  - Use the pristine nss upstream sources with ecc included

  - Export NSS_ENABLE_ECC=1 in both the build and the check     sections

  - Make failed requests for unsupoprted ssl pkcs 11 bypass     non fatal

  - Resolves: rhbz#882408 - NSS_NO_PKCS11_BYPASS must     preserve ABI

  - Related: rhbz#918950 - rebase nss to 3.14.3

nss-softokn

  - Adjust patch to be compatible with legacy softokn API.

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Resolves: Bug 1145431 - (CVE-2014-1568)

  - Skip calls to CHECK_FORK in [C & NSC]_GetFunctionList

  - Resolves: Bug 1082900 - Admin server segfault when     configuration DS configured on SSL port

  - Add workaround to %check unset DISPLAY section for     RHEL-5 based build machines where kernel lacks support     for hardware GCM

  - back out -fips package changes

  - Enable new packaging but don't apply nss-fips-post.patch

  - Related: rhbz#1008513 - Unable to login in fips mode

  - Fix the PR_Access stub to actually access the correct     permissions

  - Resolves: rhbz#1008513 - Unable to login in fips mode

  - Run the lowhash tests

  - Require nspr-4.0.0 and nss-util-3.15.1

  - create -fips packages

  - patch submitted by Bob Relyea

  - fix the script that splits softoken off from nss

  - patch nss/cmd/lib/basicutil.c to build against     nss-util-3.15.1

  - Resolves: rhbz#993441 - NSS needs to conform to new FIPS     standard. 

  - Resolves: rhbz#976572 - Pick up various upstream GCM     code fixes applied since nss-3.14.3 was released

  - Display cpuifo as part of the tests and make     NSS_DISABLE_HW_GCM the environment variable to test for

  - When appling the patches use a backup file suffix that     better describes the patch purpose

  - Enable ECC support for suite b and add upstream fixes     for aec gcm

  - Use the unstripped upstream sources with ecc support

  - Limit the ECC support to suite b

  - Apply several upstream aes gcm fixes

  - Rename macros EC_MIN_KEY_BITS and EC_MAX_KEY_BITS per     upstream

  - Resolves: rhbz#960208 - Enable ECC in nss-softoken

  - Related: rhbz#919172

nss-util

  - Resolves: bug 1145431 - (CVE-2014-1568)

  - Update to nss-3.16.1

  - Resolves: rhbz#1112136

  - Update to NSS_3_15_3_RTM

  - Resolves: rhbz#1032470 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741)

  - Preserve existing permissions when replacing existing     pkcs11.txt file, but keep strict default permissions for     new files

  - Resolves: rhbz#990631 - file permissions of     pkcs11.txt/secmod.db must be kept when modified by NSS

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix SSL_DH_MIN_P_BITS in more places.

  - Keep SSL_DH_MIN_P_BITS at 768 as in the previously     released build.

  - Run SSL tests

  - Add compatility patches to prevent regressions

  - Ensure all ssl.sh tests are executed

  - Rebase to nss 3.21

  - Resolves: Bug 1297944 - Rebase RHEL 5.11.z to NSS 3.21     in preparation for Firefox 45

  - Actually apply the fix for CVE-2016-1950 from NSS     3.19.2.3 ...

  - Include the fix for CVE-2016-1950 from NSS 3.19.2.3

  - Resolves: Bug 1269354 - CVE-2015-7182 (CVE-2015-7181)

  - Rebase nss to 3.19.1

  - Pick up upstream fix for client auth. regression caused     by 3.19.1

  - Revert upstream change to minimum key sizes

  - Remove patches that rendered obsolote by the rebase

  - Update existing patches on account of the rebase

  - Pick up upstream patch from nss-3.19.1

  - Resolves: Bug 1236954 - CVE-2015-2730 NSS: ECDSA     signature validation fails to handle some signatures     correctly (MFSA 2015-64)

  - Resolves: Bug 1236967 - CVE-2015-2721 NSS: incorrectly     permited skipping of ServerKeyExchange (MFSA 2015-71)

  - On RHEL 6.x keep the TLS version defaults unchanged.

  - Update to CKBI 2.4 from NSS 3.18.1 (the only change in     NSS 3.18.1)

  - Copy PayPalICA.cert and PayPalRootCA.cert to     nss/tests/libpkix/certs

  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL-5.11]

  - Update and reeneable nss-646045.patch on account of the     rebase

  - Enable additional ssl test cycles and document why some     aren't enabled

  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL-5.11]

  - Fix shell syntax error on nss/tests/all.sh

  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL-5.11]

  - Replace expired PayPal test certificate that breaks the     build

  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL-5.11]

  - Resolves: Bug 1200905 - Rebase nss to 3.18 for Firefox     38 ESR [RHEL-5.11]

  - Resolves: Bug 1158159 - Upgrade to NSS 3.16.2.3 for     Firefox 31.3

  - Adjust softokn patch to be compatible with legacy     softokn API.

  - Resolves: Bug 1145430 - (CVE-2014-1568)

  - Add patches published with NSS 3.16.2.1

  - Resolves: Bug 1145430 - (CVE-2014-1568)

  - Backport nss-3.12.6 upstream fix required by Firefox 31     ESR

  - Resolves: Bug 1110860

  - Rebase to nss-3.16.1 for FF31

  - Resolves: Bug 1110860 - Rebase nss in RHEL 5.11 to NSS     3.16.1, required for FF 31

  - Remove unused and obsolete patches

  - Related: Bug 1032468

  - Improve shell code for error detection on %check section

  - Resolves: Bug 1035281 - Suboptimal shell code in     nss.spec

  - Revoke trust in one mis-issued anssi certificate

  - Resolves: Bug 1042684 - nss: Mis-issued ANSSI/DCSSI     certificate (MFSA 2013-117)

  - Pick up corrections made in the rhel-10.Z branch, remove     an unused patch

  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741) nss: various flaws [rhel-5.11]

  - Remove unused patch and retag for update to nss-3.15.3

  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741) nss: various flaws [rhel-5.11]

  - Update to nss-3.15.3

  - Resolves: rhbz#1032468 - CVE-2013-5605 CVE-2013-5606     (CVE-2013-1741) nss: various flaws [rhel-5.11]

  - Remove unused patches

  - Resolves: rhbz#1002642 - Rebase RHEL 5 to NSS 3.15.1     (for FF 24.x)

  - Rebase to nss-3.15.1

  - Resolves: rhbz#1002642 - Rebase RHEL 5 to NSS 3.15.1     (for FF 24.x)

  - Resolves: rhbz#1015864 - [Regression] NSS no longer     trusts MD5 certificates

  - Split %check section tests in two: freebl/softoken and     rest of nss tests

  - Adjust various patches and spec file steps on account of     the rebase

  - Add various patches and remove obsoleted ones on account     of the rebase

  - Renumber patches so freeb/softoken ones match the     corresponding ones in rhel-6 nss-softokn

  - Make the freebl sources identical to the corresponding     ones for rhel-6.5

  - Related: rhbz#987131

  - Adjust the patches to complete the syncup with upstrean     nss

  - Use NSS_DISABLE_HW_GCM on the patch as we do on the spec     file

  - Ensure softoken/freebl code is the same on nss side as     on the softoken side

  - Related: rhbz#987131

  - Add disable_hw_gcm.patch and in the spec file export     NSS_DISABLE_HW_GCM=1

  - Disable HW GCM on RHEL-5 as the older kernel lacks     support for it

  - Related: rhbz#987131

  - Related: rhbz#987131 - Display cpuifo as part of the     tests

  - Resolves: rhbz#987131 - Pick up various upstream GCM     code fixes applied since nss-3.14.3 was released

  - Roll back to 79c87e69caa7454cbcf5f8161a628c538ff3cab3

  - Peviously added patch hasn't solved the sporadic core     dumps

  - Related: rhbz#983766 - nssutil_ReadSecmodDB leaks memory

  - Resolves: rhbz#983766 - nssutil_ReadSecmodDB leaks     memory

  - Add patch to get rid of sporadic blapitest core dumps

  - Restore 'export NO_FORK_CHECK=1' required for binary     compatibility on RHEL-5

  - Remove an unused patch

  - Resolves: rhbz#918948 - [RFE][RHEL5] Rebase to     nss-3.14.3

  - Resolves: rhbz#807419 - nss-tools certutil -H does not     list all options

  - Apply upstream fixes for ecc enabling and aes gcm

  - Rename two macros EC_MIN_KEY_BITS and EC_MAX_KEY_BITS     per upstream

  - Apply several upstream AES GCM fixes

  - Resolves: rhbz#960241 - Enable ECC in nss and freebl

  - Resolves: rhbz#918948 - [RFE][RHEL5]

  - Enable ECC support limited to suite b

  - Export NSS_ENABLE_ECC=1 in the %check section to     properly test ecc

  - Resolves: rhbz#960241 - Enable ECC in nss and freebl

  - Define -DNO_FORK_CHECK when compiling softoken for ABI     compatibility

  - Resolves: rhbz#918948 - [RFE][RHEL5] Rebase to     nss-3.14.3 to fix the lucky-13 issue

  - Remove obsolete nss-nochktest.patch

  - Related: rhbz#960241 - Enable ECC in nss and freebl

  - Enable ECC by using the unstripped sources

  - Resolves: rhbz#960241 - Enable ECC in nss and freebl

  - Fix rpmdiff test reported failures and remove other     unwanted changes

  - Resolves: rhbz#918948 - [RFE][RHEL5] Rebase to     nss-3.14.3 to fix the lucky-13 issue

  - Mon Apr 22 2013 Elio Maldonado - 3.14.3-3

  - Update to NSS_3_14_3_RTM

  - Rework the rebase to preserve needed idiosynchracies

  - Ensure we install frebl/softoken from the extra build     tree

  - Don't include freebl static library or its private     headers

  - Add patch to deal with system sqlite not being recent     enough

  - Don't install nss-sysinit nor sharedb

  - Resolves: rhbz#918948 - [RFE][RHEL5] Rebase to     nss-3.14.3 to fix the lucky-13 issue

  - Mon Apr 01 2013 Elio Maldonado - 3.14.3-2

  - Restore the freebl-softoken source tar ball updated to     3.14.3

  - Renumbering of some sources for clarity

  - Resolves: rhbz#918948 - [RFE][RHEL5] Rebase to     nss-3.14.3 to fix the lucky-13 issue

  - Update to NSS_3_14_3_RTM

  - Resolves: rhbz#918948 - [RFE][RHEL5] Rebase to     nss-3.14.3 to fix the lucky-13 issue

  - Resolves: rhbz#891150 - Dis-trust TURKTRUST mis-issued
    *.google.com certificate

  - Update to NSS_3_13_6_RTM

  - Resolves: rhbz#883788 - [RFE] [RHEL5] Rebase to NSS >=     3.13.6

  - Resolves: rhbz#820684

  - Fix last entry in attrFlagsArray to be     [NAME_SIZE(unextractable), PK11_ATTR_UNEXTRACTABLE]

  - Resolves: rhbz#820684

  - Enable certutil handle user supplied flags for PKCS #11     attributes.

  - This will enable certutil to generate keys in fussy     hardware tokens.

  - fix an error in the patch meta-information area (no code     change)

  - Related: rhbz#830304 - Fix ia64 / i386 multilib nss     install failure

  - Remove no longer needed %pre and %preun scriplets meant     for nss updates from RHEL-5.0

  - Related: rhbz#830304 - Fix the changes to the %post line

  - Having multiple commands requires that /sbin/lconfig be     the beginning of the scriptlet

  - Resolves: rhbz#830304 - Fix multilib and scriptlet     problems

  - Fix %post and %postun lines per packaging guildelines

  - Add %[?_isa] to tools Requires: per packaging guidelines

  - Fix explicit-lib-dependency zlib error reported by     rpmlint

  - Resolves: rhbz#830304 - Remove unwanted change to     nss.pc.in

  - Update to NSS_3_13_5_RTM

  - Resolves: rhbz#830304 - Update RHEL 5.x to NSS 3.13.5     and NSPR 4.9.1 for Mozilla 10.0.6

  - Resolves: rhbz#797939 - Protect NSS_Shutdown from     clients that fail to initialize nss

  - Resolves: Bug 788039 - retagging to prevent update     problems

  - Resolves: Bug 788039 - rebase nss to make firefox 10 LTS     rebase possible

  - Update to 4.8.9

  - Resolves: Bug 713373 - File descriptor leak after     service httpd reload

  - Don't initialize nss if already initialized or if there     are no dbs

  - Retagging for a Y-stream version higher than the     RHEL-5-7-Z branch

  - Retagging to keep the n-v-r as high as that for the     RHEL-5-7-Z branch

  - Update builtins certs to those from NSSCKBI_1_88_RTM

  - Plug file descriptor leaks on httpd reloads

  - Update builtins certs to those from NSSCKBI_1_87_RTM

  - Update builtins certs to those from NSSCKBI_1_86_RTM

  - Update builtins certs to NSSCKBI_1_85_RTM

  - Update to 3.12.10

  - Fix libcrmf hard-coded maximum size for wrapped private     keys

  - Update builtin certs to NSS_3.12.9_WITH_CKBI_1_82_RTM     via a patch

  - Update builtin certs to those from     NSS_3.12.9_WITH_CKBI_1_82_RTM

  - Update to 3.12.8

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91746	OracleVM 3.2 : nspr (OVMSA-2016-0065)	Nessus	OracleVM Local Security Checks	2016/6/22	2021/1/4	high
79540	OracleVM 3.3 : nss (OVMSA-2014-0023)	Nessus	OracleVM Local Security Checks	2014/11/26	2021/1/4	high
91747	OracleVM 3.2 : nss (OVMSA-2016-0066)	Nessus	OracleVM Local Security Checks	2016/6/22	2021/1/4	critical

检测

插件搜索

high

high

critical