MGASA-2013-0337

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2013-0337.html
Import Source
https://advisories.mageia.org/MGASA-2013-0337.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2013-0337
Related
Published
2013-11-20T20:54:49Z
Modified
2013-11-20T20:54:32Z
Summary
Updated firefox, rootcerts, nspr & nss packages fix security vulnerabilities
Details

Updated nspr and nss packages fix security vulnerabilities:

Potentially exploitable buffer overflow in NSS before 3.15.3 that allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets (CVE-2013-5605).

The CERT_VerifyCert function in lib/certhigh/certvfy.c in NSS before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate (CVE-2013-5606).

Runaway memset due to an integer truncation in certificate parsing on 64-bit computers in NSS before 3.15.3 leading to a crash by attempting to write 4Gb of nulls (CVE-2013-1741).

Integer overflow in NSPR before 4.10.2 due to unsigned integer wrapping in PL_ArenaAllocate (CVE-2013-5607).

NSS lowered the priority of RC4 in cipher suite advertisement so that more secure ciphers instead of RC4 are likely to be chosen by the server, because of plaintext recovery attacks possible with RC4 (CVE-2013-2566).

This also updates to the latest root certificate data from Mozilla.

Additionally, The latest Firefox ESR version, which fixes an issue with translated strings not being used in some cases, is also being provided.

References
Credits

Affected packages

Mageia:3 / rootcerts

Package

Name
rootcerts
Purl
pkg:rpm/mageia/rootcerts?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20131111.00-1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / nspr

Package

Name
nspr
Purl
pkg:rpm/mageia/nspr?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.10.2-1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / nss

Package

Name
nss
Purl
pkg:rpm/mageia/nss?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.15.3-1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / firefox

Package

Name
firefox
Purl
pkg:rpm/mageia/firefox?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
24.1.1-1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / firefox-l10n

Package

Name
firefox-l10n
Purl
pkg:rpm/mageia/firefox-l10n?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
24.1.1-1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:2 / rootcerts

Package

Name
rootcerts
Purl
pkg:rpm/mageia/rootcerts?distro=mageia-2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20131111.00-1.mga2

Ecosystem specific 

{
    "section": "core"
}

Mageia:2 / nspr

Package

Name
nspr
Purl
pkg:rpm/mageia/nspr?distro=mageia-2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.10.2-1.mga2

Ecosystem specific 

{
    "section": "core"
}

Mageia:2 / nss

Package

Name
nss
Purl
pkg:rpm/mageia/nss?distro=mageia-2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.15.3-1.mga2

Ecosystem specific 

{
    "section": "core"
}

Mageia:2 / firefox

Package

Name
firefox
Purl
pkg:rpm/mageia/firefox?distro=mageia-2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
24.1.1-1.mga2

Ecosystem specific 

{
    "section": "core"
}

Mageia:2 / firefox-l10n

Package

Name
firefox-l10n
Purl
pkg:rpm/mageia/firefox-l10n?distro=mageia-2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
24.1.1-1.mga2

Ecosystem specific 

{
    "section": "core"
}