A vulnerability has been discovered in NSS, which can lead to the recovery of private data.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.98 | >= 3.98 |
The Mozilla Network Security Service is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
A vulnerability has been discovered in Mozilla Network Security Service (NSS). Please review the CVE identifier referenced below for details.
Please review the referenced CVE identifier for details.
There is no known workaround at this time.
All Mozilla Network Security Service (NSS) users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.98"
Multiple vulnerabilities have been discovered in NSS, the worst of which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.79.2 | >= 3.79.2 |
The Mozilla Network Security Service is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
Multiple vulnerabilities have been discovered in Mozilla Network Security Service (NSS). Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Mozilla Network Security Service (NSS) users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.79.2"
A vulnerability in NSS might allow remote attackers to cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.58 | >= 3.58 |
The Mozilla Network Security Service (NSS) is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
A flaw was found in the way Mozilla Network Security Service (NSS) handled CCS (ChangeCipherSpec) messages in TLS 1.3.
A remote attacker could send multiple crafted CSS messages in row after ClientHello message to a server application linked against NSS library, possibly resulting in a Denial of Service condition.
Disable TLS 1.3 protocol.
All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.58"
NSS has multiple information disclosure vulnerabilities when handling secret key material.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.55 | >= 3.55 |
The Mozilla Network Security Service (NSS) is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
Multiple vulnerabilities have been discovered in NSS. Please review the CVE identifiers referenced below for details.
An attacker may be able to obtain information about secret key material.
There is no known workaround at this time.
All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.55"
NSS has an information disclosure vulnerability when handling DSA keys.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.52.1 | >= 3.52.1 |
The Mozilla Network Security Service (NSS) is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
NSS was found to not always perform constant-time operations when working with DSA key material.
An attacker may be able to obtain information about a DSA private key.
There is no known workaround at this time.
All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.52.1"
Multiple vulnerabilities have been found in Mozilla Network Security Service (NSS), the worst of which may lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.49 | >= 3.49 |
The Mozilla Network Security Service (NSS) is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
Multiple vulnerabilities have been discovered in Mozilla Network Security Service (NSS). Please review the CVE identifiers referenced below for details.
An attacker could execute arbitrary code, cause a Denial of Service condition or have other unspecified impact.
There is no known workaround at this time.
All Mozilla Network Security Service (NSS) users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.49"
Multiple vulnerabilities have been found in NSS, the worst of which may allow execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.29.5 | >= 3.29.5 |
The Mozilla Network Security Service (NSS) is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
Multiple vulnerabilities have been discovered in NSS. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or view sensitive information.
There is no known workaround at this time.
All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.29.5"
Multiple vulnerabilities have been found in NSS, the worst of which could allow remote attackers to obtain access to private key information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.28 | >= 3.28 |
The Mozilla Network Security Service (NSS) is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
Multiple vulnerabilities have been discovered in NSS. Please review the CVE identifiers and technical papers referenced below for details.
Remote attackers could conduct man-in-the-middle attacks, obtain access to private key information, or cause a Denial of Service condition.
There is no known workaround at this time.
All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.28"
Multiple vulnerabilities have been found in Firefox, Thunderbird, Network Security Services (NSS), and NetScape Portable Runtime (NSPR) with the worst of which may allow remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nspr | * | < 4.12 | >= 4.12 |
| dev-libs/nss | * | < 3.22.2 | >= 3.22.2 |
| mail-client/thunderbird | * | < 38.7.0 | >= 38.7.0 |
| mail-client/thunderbird-bin | * | < 38.7.0 | >= 38.7.0 |
| www-client/firefox | * | < 38.7.0 | >= 38.7.0 |
| www-client/firefox-bin | * | < 38.7.0 | >= 38.7.0 |
Mozilla Firefox is an open-source web browser, Mozilla Thunderbird an open-source email client, and the Network Security Service (NSS) is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates. The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as ‘Mozilla Application Suite’.
Multiple vulnerabilities have been discovered in Firefox, NSS, NSPR, and Thunderbird. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impacts.
There is no known workaround at this time.
All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.22.2"
All Thunderbird users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-38.7.0"
All users of the Thunderbird binary package should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-bin-38.7.0"
All Firefox 38.7.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-38.7.0"
All users of the Firefox 38.7.x binary package should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-38.7.0"
Multiple vulnerabilities have been discovered in Mozilla Network Security Service, the worst of which could lead to Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.15.3 | >= 3.15.3 |
The Mozilla Network Security Service is a library implementing security features like SSL v2/v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
Multiple vulnerabilities have been discovered in the Mozilla Network Security Service. Please review the CVE identifiers referenced below for more details about the vulnerabilities.
A remote attacker can cause a Denial of Service condition.
There is no known workaround at this time.
All Mozilla Network Security Service users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.15.3"
Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages.
Multiple vulnerabilities have been found in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner, some of which may allow execution of arbitrary code or local privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.14 | >= 3.14 |
| mail-client/mozilla-thunderbird | * | <= 3.0.4-r1 | — |
| mail-client/mozilla-thunderbird-bin | * | <= 3.0 | — |
| mail-client/thunderbird | * | < 10.0.11 | >= 10.0.11 |
| mail-client/thunderbird-bin | * | < 10.0.11 | >= 10.0.11 |
| net-libs/xulrunner | * | <= 2.0-r1 | — |
| net-libs/xulrunner-bin | * | <= 1.8.1.19 | — |
| www-client/firefox | * | < 10.0.11 | >= 10.0.11 |
| www-client/firefox-bin | * | < 10.0.11 | >= 10.0.11 |
| www-client/icecat | * | <= 10.0-r1 | — |
| www-client/mozilla-firefox | * | <= 3.6.8 | — |
| www-client/mozilla-firefox-bin | * | <= 3.5.6 | — |
| www-client/seamonkey | * | < 2.14-r1 | >= 2.14-r1 |
| www-client/seamonkey-bin | * | < 2.14 | >= 2.14 |
Mozilla Firefox is an open-source web browser and Mozilla Thunderbird an open-source email client, both from the Mozilla Project. The SeaMonkey project is a community effort to deliver production-quality releases of code derived from the application formerly known as the ‘Mozilla Application Suite’. XULRunner is a Mozilla runtime package that can be used to bootstrap XUL+XPCOM applications such as Firefox and Thunderbird. NSS is Mozilla’s Network Security Services library that implements PKI support. IceCat is the GNU version of Firefox.
Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, SeaMonkey, NSS, GNU IceCat, and XULRunner. Please review the CVE identifiers referenced below for details.
A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, bypass restrictions and protection mechanisms, force file downloads, conduct XML injection attacks, conduct XSS attacks, bypass the Same Origin Policy, spoof URL’s for phishing attacks, trigger a vertical scroll, spoof the location bar, spoof an SSL indicator, modify the browser’s font, conduct clickjacking attacks, or have other unspecified impact.
A local attacker could gain escalated privileges, obtain sensitive information, or replace an arbitrary downloaded file.
There is no known workaround at this time.
All Mozilla Firefox users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-10.0.11"
All users of the Mozilla Firefox binary package should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-10.0.11"
All Mozilla Thunderbird users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-10.0.11"
All users of the Mozilla Thunderbird binary package should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-bin-10.0.11"
All Mozilla SeaMonkey users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/seamonkey-2.14-r1"
All users of the Mozilla SeaMonkey binary package should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/seamonkey-bin-2.14"
All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.14"
The “www-client/mozilla-firefox” package has been merged into the “www-client/firefox” package. To upgrade, please unmerge “www-client/mozilla-firefox” and then emerge the latest “www-client/firefox” package:
# emerge --sync # emerge --unmerge "www-client/mozilla-firefox" # emerge --ask --oneshot --verbose ">=www-client/firefox-10.0.11"
The “www-client/mozilla-firefox-bin” package has been merged into the “www-client/firefox-bin” package. To upgrade, please unmerge “www-client/mozilla-firefox-bin” and then emerge the latest “www-client/firefox-bin” package:
# emerge --sync # emerge --unmerge "www-client/mozilla-firefox-bin" # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-10.0.11"
The “mail-client/mozilla-thunderbird” package has been merged into the “mail-client/thunderbird” package. To upgrade, please unmerge “mail-client/mozilla-thunderbird” and then emerge the latest “mail-client/thunderbird” package:
# emerge --sync # emerge --unmerge "mail-client/mozilla-thunderbird" # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-10.0.11"
The “mail-client/mozilla-thunderbird-bin” package has been merged into the “mail-client/thunderbird-bin” package. To upgrade, please unmerge “mail-client/mozilla-thunderbird-bin” and then emerge the latest “mail-client/thunderbird-bin” package:
# emerge --sync # emerge --unmerge "mail-client/mozilla-thunderbird-bin" # emerge --ask --oneshot --verbose ">=mail-client/thunderbird-bin-10.0.11"
Gentoo discontinued support for GNU IceCat. We recommend that users unmerge GNU IceCat:
# emerge --unmerge "www-client/icecat"
Gentoo discontinued support for XULRunner. We recommend that users unmerge XULRunner:
# emerge --unmerge "net-libs/xulrunner"
Gentoo discontinued support for the XULRunner binary package. We recommend that users unmerge XULRunner:
# emerge --unmerge "net-libs/xulrunner-bin"
The Mozilla Network Security Services libraries are vulnerable to two buffer overflows that could result in the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.11.5 | >= 3.11.5 |
The Mozilla Network Security Service is a library implementing security features like SSL v2/v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
iDefense has reported two potential buffer overflow vulnerabilities found by researcher "regenrecht" in the code implementing the SSLv2 protocol.
A remote attacker could send a specially crafted SSL master key to a server using NSS for the SSLv2 protocol, or entice a user to connect to a malicious server with a client-side application using NSS like one of the Mozilla products. This could trigger the vulnerabilities and result in the possible execution of arbitrary code with the rights of the vulnerable application.
Disable the SSLv2 protocol in the applications using NSS.
All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.11.5"
NSS fails to properly validate PKCS #1 v1.5 signatures.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-libs/nss | * | < 3.11.3 | >= 3.11.3 |
The Mozilla Network Security Service is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates.
Daniel Bleichenbacher discovered that it might be possible to forge signatures signed by RSA keys with the exponent of 3. This affects a number of RSA signature implementations, including Mozilla's NSS.
Since several Certificate Authorities (CAs) are using an exponent of 3 it might be possible for an attacker to create a key with a false CA signature. This impacts any software using the NSS library, like the Mozilla products Firefox, Thunderbird and Seamonkey.
There is no known workaround at this time.
All NSS users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/nss-3.11.3"
Note: As usual after updating a library, you should run 'revdep-rebuild' (from the app-portage/gentoolkit package) to ensure that all applications linked to it are properly rebuilt.