Sikkerhedsoplysninger / 2014 / Sikkerhedsoplysninger -- DSA-2994-1 nss

Debians sikkerhedsbulletin

DSA-2994-1 nss -- sikkerhedsopdatering

Rapporteret den:

31. jul 2014

Berørte pakker:

nss

Sårbar:

Ja

Referencer i sikkerhedsdatabaser:

I Mitres CVE-ordbog: CVE-2013-1741, CVE-2013-5606, CVE-2014-1491, CVE-2014-1492.

Yderligere oplysninger:

Flere sårbarheder have been discovered in nss, the Mozilla Network Security Service library:

• CVE-2013-1741

  Runaway memset in certificate parsing on 64-bit computers leading to a crash by attempting to write 4Gb of nulls.

• CVE-2013-5606

  Certificate validation with the verifylog mode did not return validation errors, but instead expected applications to determine the status by looking at the log.

• CVE-2014-1491

  Ticket handling protection mechanisms bypass due to the lack of restriction of public values in Diffie-Hellman key exchanges.

• CVE-2014-1492

  Incorrect IDNA domain name matching for wildcard certificates could allow specially-crafted invalid certificates to be considered as valid.

I den stabile distribution (wheezy), er disse problemer rettet i version 2:3.14.5-1+deb7u1.

For the distributionen testing (jessie), and the ustabile distribution (sid), er disse problemer rettet i version 2:3.16-1.

Vi anbefaler at du opgraderer dine nss-pakker.