Synopsis
Critical: nspr and nss security, bug fix, and enhancement update
Type/Severity
Security Advisory: Critical
Topic
Updated nspr and nss packages that fix security issues, bugs, and add anenhancement are now available for Red Hat Enterprise Linux 5This update has been rated as having critical securit ...
Synopsis
Critical: nspr and nss security and bug fix update
Type/Severity
Security Advisory: Critical
Topic
Updated nspr and nss packages that fix security issues and bugs are nowavailable for Red Hat Enterprise Linux 47 Extended Update SupportThis update has been rated as having critical security impact ...
Synopsis
Critical: nspr and nss security and bug fix update
Type/Severity
Security Advisory: Critical
Topic
Updated nspr and nss packages that fix security issues and a bug are nowavailable for Red Hat Enterprise Linux 4This update has been rated as having critical security impact by the RedHat Security Re ...
Several vulnerabilities have been discovered in the Network Security
Service libraries The Common Vulnerabilities and Exposures project
identifies the following problems:
CVE-2009-2404
Moxie Marlinspike discovered that a buffer overflow in the regular
expression parser could lead to the execution of arbitrary code
CVE-2009-2408
Dan Kami ...
Several remote vulnerabilities have been discovered in the Icedove
mail client, an unbranded version of the Thunderbird mail client The
Common Vulnerabilities and Exposures project identifies the following
problems:
CVE-2009-2408
Dan Kaminsky and Moxie Marlinspike discovered that icedove does not
properly handle a '\0' character in a domain name ...
Moxie Marlinspike discovered that NSS did not properly handle regular
expressions in certificate names A remote attacker could create a
specially crafted certificate to cause a denial of service (via application
crash) or execute arbitrary code as the user invoking the program
(CVE-2009-2404) ...
USN-810-1 fixed vulnerabilities in NSS This update provides the NSPR
needed to use the new NSS ...
USN-810-1 fixed vulnerabilities in NSS Jozsef Kadlecsik noticed that
the new libraries on amd64 did not correctly set stack memory flags,
and caused applications using NSS (eg Firefox) to have an executable
stack This reduced the effectiveness of some defensive security
protections This update fixes the problem ...
Debian Bug report logs -
#539934
CVE-2009-2408, CVE-2009-2404, NSS multiple vulnerabilities
Package:
nss;
Maintainer for nss is Maintainers of Mozilla-related packages <team+pkg-mozilla@trackerdebianorg>;
Reported by: Giuseppe Iuculano <giuseppe@iuculanoit>
Date: Tue, 4 Aug 2009 15:03:02 UTC
Severity: serious
Tag ...
Debian Bug report logs -
#553432
CVE-2009-3767: Doesn't properly handle NULL character in subject Common Name
Package:
openldap;
Maintainer for openldap is Debian OpenLDAP Maintainers <pkg-openldap-devel@listsaliothdebianorg>;
Reported by: Giuseppe Iuculano <iuculano@debianorg>
Date: Sat, 31 Oct 2009 10:00:01 UTC
...
Debian Bug report logs -
#564581
CVE-2009-4565: does not properly handle a '\0' character in a Common Name (CN) field of an X509 certificate
Package:
sendmail;
Maintainer for sendmail is Debian QA Group <packages@qadebianorg>; Source for sendmail is src:sendmail (PTS, buildd, popcon)
Reported by: Giuseppe Iuculano <iuc ...
Debian Bug report logs -
#549293
CVE-2009-3490: does not properly handle a '\0' character in a domain name in the Common Name field of an X509 certificate
Package:
wget;
Maintainer for wget is Noël Köthe <noel@debianorg>; Source for wget is src:wget (PTS, buildd, popcon)
Reported by: Giuseppe Iuculano <giuseppe@iucula ...
Debian Bug report logs -
#542926
CVE-2009-2474: Improper verification of x590v3 certificate with NUL (zero) byte in certain fields
Packages:
neon27, neon, neon26;
Maintainer for neon27 is Laszlo Boszormenyi (GCS) <gcs@debianorg>; Maintainer for neon is (unknown); Maintainer for neon26 is (unknown);
Reported by: Giuseppe Iucu ...
Debian Bug report logs -
#545793
CVE-2009-2700: QSslCertificate incorrect verification of SSL certificate with NUL in subjectAltName
Package:
qt4-x11;
Maintainer for qt4-x11 is Debian Qt/KDE Maintainers <debian-qt-kde@listsdebianorg>;
Reported by: Giuseppe Iuculano <giuseppe@iuculanoit>
Date: Wed, 9 Sep 2009 08:00 ...
Debian Bug report logs -
#546212
CVE-2009-2702: KDE KSSL NULL Character Certificate Spoofing Vulnerability
Package:
kdelibs;
Maintainer for kdelibs is (unknown);
Reported by: Giuseppe Iuculano <giuseppe@iuculanoit>
Date: Fri, 11 Sep 2009 17:42:02 UTC
Severity: serious
Tags: security
Fixed in versions kdelibs/4:3510dfs ...
Mozilla Foundation Security Advisory 2009-42
Compromise of SSL-protected communication
Announced
August 1, 2009
Reporter
Dan Kaminsky
Impact
Critical
Products
Firefox, NSS, SeaMonkey, Thunderbird
Fixed in
...
Vulmon