CVSS: 5.8EPSS: 0%CPEs: 47EXPL: 1CVE-2013-1740 – nss: false start PR_Recv information disclosure security issue
https://notcve.org/view.php?id=CVE-2013-1740
The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic. La función ssl_Do1stHandshake en sslsecur.c en libssl de Mozilla Network Security Services (NSS) anteriores a 3.15.4, cuando la funcionalidad TLS False Start está habilitada, permite a atacantes man-in-the-middle falsear servidores SSL utilizando un certificado X.509 arbitrario durante cierto tráfico de handshake. A flaw was found in the way TLS False Start was implemented in NSS. An attacker could use this flaw to potentially return unencrypted information from the server. • http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html http://seclists.org/fulldisclosure/2014/Dec/23 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html http://www.oracle • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 9%CPEs: 8EXPL: 0CVE-2013-5605 – nss: Null_Cipher() does not respect maxOutputLen (MFSA 2013-103)
https://notcve.org/view.php?id=CVE-2013-5605
Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets. Servicios de seguridad de red Mozilla (NSS) 3.14 antes de 3.14.5 y 3.15 antes de 3.15.3 permite a atacantes remotos provocar una denegación de servicio o posiblemente tener un impacto no especificado a través de paquetes handshake no válidos. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00000.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00078.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00080.html http://rhn.redhat.com/errata/RHSA-2013-1791.html http://rhn.redhat.com/errata/RHSA-2013-1829.html http://rhn.redhat.com/errata/RHSA-2013-1840.html http://rhn.redhat.com/errata/RHSA-2013-1841.html http://rhn. • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-5606 – nss: CERT_VerifyCert returns SECSuccess (saying certificate is good) even for bad certificates (MFSA 2013-103)
https://notcve.org/view.php?id=CVE-2013-5606
The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate. La función CERT_VerifyCert en lib / certhigh / certvfy.c de Servicios de Seguridad de Mozilla red (NSS) 3.15 antes de 3 3.15 proporciona un valor inesperado de retorno para un certificado de clave-uso incompatible cuando el argumento CERTVerifyLog es válido, lo que podría permitir a atacantes remotos evitar restricciones de acceso destinados a través de un certificado manipulado • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00000.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00080.html http://rhn.redhat.com/errata/RHSA-2013-1791.html http://rhn.redhat.com/errata/RHSA-2013-1829.html http://rhn.redhat.com/errata/RHSA-2014-0041.html http://seclists.org/fulldisclosure/2014/Dec/23 http://security.gentoo.org/glsa/glsa-201406-19.xml http://www.debian.org/securi • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 10%CPEs: 3EXPL: 0CVE-2013-1741 – nss: Integer truncation in certificate parsing (MFSA 2013-103)
https://notcve.org/view.php?id=CVE-2013-1741
Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large size value. Desbordamiento de enteros en Mozilla Network Security Services (NSS) 3.15.3 anterior 3.15 que permite a atacantes remotos provocar una denegación de servicio o posiblemente tener otro impacto no especificado a través de un valor de gran tamaño. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00000.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00080.html http://rhn.redhat.com/errata/RHSA-2013-1791.html http://rhn.redhat.com/errata/RHSA-2013-1829.html http://seclists.org/fulldisclosure/2014/Dec • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 11%CPEs: 20EXPL: 0CVE-2013-1739 – nss: Avoid uninitialized data read in the event of a decryption failure
https://notcve.org/view.php?id=CVE-2013-1739
Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure. Mozilla Network Security Services (NSS) en versiones anteriores a 3.15.2 no asegura que las estructuras de datos estén inicializadas antes de las operaciones de lectura, lo que permite a atacantes remotos provocar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores que desencadenan un fallo de descifrado. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html http://lists.opensuse.org/opensuse-updates/2013-10/msg00013.html http://lists.opensuse.org/opensuse-updates/2013-10/msg00016.html http://rhn.redhat.com/errata/RHSA-2013-1791.html http://rhn.redhat.com/errata/RHSA-2013-1829.html http://seclists.org/fulldisclosure/2014/Dec/23 http://security.gentoo.org/glsa/glsa-201406-19.xml http://www.debia •