The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-1791 advisory.

    - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]
    - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]
    - Resolves: rhbz#1032466 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741 nss: various flaws [rhel-5.10]

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605)

It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739)

An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607)

It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate.
(CVE-2013-5606)

Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607.

In addition, the nss package has been upgraded to upstream version 3.15.3, and the nspr package has been upgraded to upstream version 4.10.2. These updates provide a number of bug fixes and enhancements over the previous versions. (BZ#1033478, BZ#1020520)

This update also fixes the following bug :

* The RHBA-2013:1318 update introduced a regression that prevented the use of certificates that have an MD5 signature. This update fixes this regression and certificates that have an MD5 signature are once again supported. To prevent the use of certificates that have an MD5 signature, set the 'NSS_HASH_ALG_SUPPORT' environment variable to '-MD5'. (BZ#1033499)

Users of NSS and NSPR are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing this update, applications using NSS or NSPR must be restarted for this update to take effect.

Updated nss, nspr, and nss-util packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. (CVE-2013-5605)

It was found that the fix for CVE-2013-1620 released via RHSA-2013:1135 introduced a regression causing NSS to read uninitialized data when a decryption failure occurred. A remote attacker could use this flaw to cause a TLS/SSL server using NSS to crash. (CVE-2013-1739)

An integer overflow flaw was discovered in both NSS and NSPR's implementation of certification parsing on 64-bit systems. A remote attacker could use these flaws to cause an application using NSS or NSPR to crash. (CVE-2013-1741, CVE-2013-5607)

It was discovered that NSS did not reject certificates with incompatible key usage constraints when validating them while the verifyLog feature was enabled. An application using the NSS certificate validation API could accept an invalid certificate.
(CVE-2013-5606)

Red Hat would like to thank the Mozilla project for reporting CVE-2013-1741, CVE-2013-5606, and CVE-2013-5607. Upstream acknowledges Tavis Ormandy as the original reporter of CVE-2013-1741, Camilo Viecco as the original reporter of CVE-2013-5606, and Pascal Cuoq, Kamil Dudka, and Wan-Teh Chang as the original reporters of CVE-2013-5607.

All NSS, NSPR, and nss-util users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing this update, applications using NSS, NSPR, or nss-util must be restarted for this update to take effect.

This update rebases the nss, nss-util, and nss-softokn packages to nss-3.15.3 and nspr to nspr-4.10.2 in order to address security-relevant bugs that have been resolved in NSS 3.15.3.

For further details please refer to the upstream release notes at

https://developer.mozilla.org/en-US/docs/NSS/NSS_3.15.3_release_notes

For best results you should upgrade all packages at once including any devel packages.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has nss packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way NSS responded to an     SSLv2-compatible ClientHello with a ServerHello that had     an all-zero random. A man-in-the-middle attacker could     use this flaw in a passive replay attack.
    (CVE-2018-12384)

  - The TLS implementation in Mozilla Network Security     Services (NSS) does not properly consider timing side-     channel attacks on a noncompliant MAC check operation     during the processing of malformed CBC padding, which     allows remote attackers to conduct distinguishing     attacks and plaintext-recovery attacks via statistical     analysis of timing data for crafted packets, a related     issue to CVE-2013-0169. (CVE-2013-1620)

  - Mozilla Network Security Services (NSS) before 3.15.2     does not ensure that data structures are initialized     before read operations, which allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via vectors that trigger a decryption     failure. (CVE-2013-1739)

  - A flaw was found in the way TLS False Start was     implemented in NSS. An attacker could use this flaw to     potentially return unencrypted information from the     server. (CVE-2013-1740)

  - Integer overflow in Mozilla Network Security Services     (NSS) 3.15 before 3.15.3 allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via a large size value. (CVE-2013-1741)

  - Mozilla Network Security Services (NSS) 3.14 before     3.14.5 and 3.15 before 3.15.3 allows remote attackers to     cause a denial of service or possibly have unspecified     other impact via invalid handshake packets.
    (CVE-2013-5605)

  - The CERT_VerifyCert function in lib/certhigh/certvfy.c     in Mozilla Network Security Services (NSS) 3.15 before     3.15.3 provides an unexpected return value for an     incompatible key-usage certificate when the     CERTVerifyLog argument is valid, which might allow     remote attackers to bypass intended access restrictions     via a crafted certificate. (CVE-2013-5606)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0467 advisory.

    This advisory aggregates security fixes for the nss SRPM in CIQ LTS 9.2. It addresses 7 CVEs:
    CVE-2023-0767, CVE-2013-1620, CVE-2013-5606, CVE-2023-5388, CVE-2021-43527, and 2 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host has a version of Oracle WebLogic Server installed that is affected by multiple unspecified vulnerabilities affecting the following components :

  - WebLogic Tuxedo Connector
  - WLS-Console (Struts based)
  - WLS-Console

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
71241	Oracle Linux 5 : nss / and / nspr (ELSA-2013-1791)	Nessus	Oracle Linux Local Security Checks	2013/12/6	2025/4/29	critical
71243	RHEL 5 : nss and nspr (RHSA-2013:1791)	Nessus	Red Hat Local Security Checks	2013/12/6	2021/1/14	high
71390	RHEL 6 : nss, nspr, and nss-util (RHSA-2013:1829)	Nessus	Red Hat Local Security Checks	2013/12/13	2021/1/14	high
71594	Fedora 18 : nss-3.15.3-1.fc18 / nss-softokn-3.15.3-1.fc18 / nss-util-3.15.3-1.fc18 (2013-23479)	Nessus	Fedora Local Security Checks	2013/12/23	2021/1/11	high
127200	NewStart CGSL CORE 5.04 / MAIN 5.04 : nss Multiple Vulnerabilities (NS-SA-2019-0033)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2025/11/20	medium
355598	Rocky Linux 9.2 [CIQ] Security Update: nspr / nspr-devel / nss / nss-devel / nss-pkcs11-devel / etc Multiple Vulnerabilities (ciqsa-2026_0467)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
78541	Oracle WebLogic Server Multiple Vulnerabilities (October 2014 CPU)	Nessus	Misc.	2014/10/17	2026/11/12	high

检测

插件搜索

critical

high

high

high

medium

critical

high