CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2013-5606 – nss: CERT_VerifyCert returns SECSuccess (saying certificate is good) even for bad certificates (MFSA 2013-103)
https://notcve.org/view.php?id=CVE-2013-5606
The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate. La función CERT_VerifyCert en lib / certhigh / certvfy.c de Servicios de Seguridad de Mozilla red (NSS) 3.15 antes de 3 3.15 proporciona un valor inesperado de retorno para un certificado de clave-uso incompatible cuando el argumento CERTVerifyLog es válido, lo que podría permitir a atacantes remotos evitar restricciones de acceso destinados a través de un certificado manipulado • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00000.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00080.html http://rhn.redhat.com/errata/RHSA-2013-1791.html http://rhn.redhat.com/errata/RHSA-2013-1829.html http://rhn.redhat.com/errata/RHSA-2014-0041.html http://seclists.org/fulldisclosure/2014/Dec/23 http://security.gentoo.org/glsa/glsa-201406-19.xml http://www.debian.org/securi • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 10%CPEs: 3EXPL: 0CVE-2013-1741 – nss: Integer truncation in certificate parsing (MFSA 2013-103)
https://notcve.org/view.php?id=CVE-2013-1741
Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large size value. Desbordamiento de enteros en Mozilla Network Security Services (NSS) 3.15.3 anterior 3.15 que permite a atacantes remotos provocar una denegación de servicio o posiblemente tener otro impacto no especificado a través de un valor de gran tamaño. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00000.html http://lists.opensuse.org/opensuse-updates/2013-11/msg00080.html http://rhn.redhat.com/errata/RHSA-2013-1791.html http://rhn.redhat.com/errata/RHSA-2013-1829.html http://seclists.org/fulldisclosure/2014/Dec • CWE-189: Numeric Errors •
CVSS: 5.0EPSS: 11%CPEs: 20EXPL: 0CVE-2013-1739 – nss: Avoid uninitialized data read in the event of a decryption failure
https://notcve.org/view.php?id=CVE-2013-1739
Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure. Mozilla Network Security Services (NSS) en versiones anteriores a 3.15.2 no asegura que las estructuras de datos estén inicializadas antes de las operaciones de lectura, lo que permite a atacantes remotos provocar una denegación de servicio o posiblemente tener otro impacto no especificado a través de vectores que desencadenan un fallo de descifrado. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html http://lists.opensuse.org/opensuse-updates/2013-10/msg00013.html http://lists.opensuse.org/opensuse-updates/2013-10/msg00016.html http://rhn.redhat.com/errata/RHSA-2013-1791.html http://rhn.redhat.com/errata/RHSA-2013-1829.html http://seclists.org/fulldisclosure/2014/Dec/23 http://security.gentoo.org/glsa/glsa-201406-19.xml http://www.debia •