bugtraq - [ MDVSA-2014:252 ] nss

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 15 Dec 2014 12:12:00 +0100
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2014:252 ] nss

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:252
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : nss
 Date    : December 15, 2014
 Affected: Business Server 1.0
 _______________________________________________________________________

 Problem Description:

 Updated nss packages fix security vulnerabilities:

 In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of
 lengths is too permissive, allowing undetected smuggling of arbitrary
 data (CVE-2014-1569).

 This update adds support for the TLS Fallback Signaling Cipher Suite
 Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol
 downgrade attacks against applications which re-connect using a lower
 SSL/TLS protocol version when the initial connection indicating the
 highest supported protocol version fails. This can prevent a forceful
 downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566,
 also known as POODLE.  SSL 3.0 support has also been disabled by
 default in this Firefox and Thunderbird update, further mitigating
 POODLE.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1569
 http://advisories.mageia.org/MGASA-2014-0507.html
 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 1/X86_64:
 fc10a003360b8afb464df7b305c18127  mbs1/x86_64/lib64nss3-3.17.3-1.mbs1.x86_64.rpm
 d905a80bfbca9dfe020ca223b4778e61  mbs1/x86_64/lib64nss-devel-3.17.3-1.mbs1.x86_64.rpm
 8fc7041f46189c8c0c89db593ee5da11  mbs1/x86_64/lib64nss-static-devel-3.17.3-1.mbs1.x86_64.rpm
 fbdbd1016983804aecd74764b106642b  mbs1/x86_64/nss-3.17.3-1.mbs1.x86_64.rpm
 7c0c88abd44a83fb87304d677977e183  mbs1/x86_64/nss-doc-3.17.3-1.mbs1.noarch.rpm
 ef3f32df47bcf9ced2ecb14b5bcd1439  mbs1/x86_64/rootcerts-20141117.00-1.mbs1.x86_64.rpm
 b7b5939180d3f43310e1ee31e11bf087  mbs1/x86_64/rootcerts-java-20141117.00-1.mbs1.x86_64.rpm 
 cdd11c0294e9c4dc54a896cd3e4c6170  mbs1/SRPMS/nss-3.17.3-1.mbs1.src.rpm
 f5e57b2f9ff644f36a26e2c80759accc  mbs1/SRPMS/rootcerts-20141117.00-1.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUjrQDmqjQ0CJFipgRAiUvAJ9meLgw3zNCQfXMfIO4VWcIwFqrKACglVBu
6kKTP01FwHyn4dFFz1WDHRU=
=k8XV
-----END PGP SIGNATURE-----