According to the versions of the nss packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NSS has shown timing differences when performing DSA     signatures, which was exploitable and could eventually     leak private keys. This vulnerability affects     Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR <     68.9.(CVE-2020-12399)

  - When converting coordinates from projective to affine,     the modular inversion was not performed in constant     time, resulting in a possible timing-based side channel     attack. This vulnerability affects Firefox < 80 and     Firefox for Android < 80.(CVE-2020-12400)

  - A flaw was found in the way CHACHA20-POLY1305 was     implemented in NSS. When using multi-part Chacha20, it     could cause out-of-bounds reads. This issue was fixed     by explicitly disabling multi-part ChaCha20 (which was     not functioning correctly) and strictly enforcing tag     length. The highest threat from(CVE-2020-12403)

  - A flaw was found in the way NSS handled CCS     (ChangeCipherSpec) messages in TLS 1.3. This flaw     allows a remote attacker to send multiple CCS messages,     causing a denial of service for servers compiled with     the NSS library. The highest threat from this     vulnerability is to system availability. This flaw     affects NSS versions before 3.58.(CVE-2020-25648)

  - In Network Security Services before 3.44, a malformed     Netscape Certificate Sequence can cause NSS to crash,     resulting in a denial of service.(CVE-2019-17007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Thunderbird installed on the remote Windows host is prior to 68.9.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2020-22 advisory.

  - Mozilla developers Tom Tung and Karl Tomlinson reported memory safety bugs present in Firefox 68.8. Some     of these bugs showed evidence of memory corruption and we presume that with enough effort some of these     could have been exploited to run arbitrary code. (CVE-2020-12410)

  - NSS has shown timing differences when performing DSA signatures, which was exploitable and could     eventually leak private keys. (CVE-2020-12399)

  - When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a     potentially exploitable crash. (CVE-2020-12405)

  - Mozilla developer Iain Ireland discovered a missing type check during unboxed objects removal, resulting     in a crash. We presume that with enough effort that it could be exploited to run arbitrary code.
    (CVE-2020-12406)

  - If Thunderbird is configured to use STARTTLS for an IMAP server, and the server sends a PREAUTH response,     then Thunderbird will continue with an unencrypted connection, causing email data to be sent without     protection. (CVE-2020-12398)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New mozilla-thunderbird packages are available for Slackware 14.2 and
-current to fix security issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4383-1 advisory.

    Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially     crafted website, an attacker could potentially exploit these to cause a denial of service, spoof the     addressbar, or execute arbitrary code. (CVE-2020-12405, CVE-2020-12406, CVE-2020-12407, CVE-2020-12408,     CVE-2020-12409, CVE-2020-12410, CVE-2020-12411)

    It was discovered that NSS showed timing differences when performing DSA signatures. An attacker could     potentially exploit this to obtain private keys using a timing attack. (CVE-2020-12399)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security issues have been found in Thunderbird which could result in the setup of a non-encrypted IMAP connection, denial of service or potentially the execution of arbitrary code.

For Debian 8 'Jessie', these problems have been fixed in version 1:68.9.0-1~deb8u2.

NOTE: 1:68.9.0esr-1~deb8u2 fixes an i386 build error in the otherwise identical 1:68.9.0esr-1~deb8u1 that was uploaded but not announced.

We recommend that you upgrade your thunderbird packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for mozilla-nspr, mozilla-nss fixes the following issues :

mozilla-nss was updated to version 3.53.1

CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032).

CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978).

CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819).

Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669).

Fixed an issue where Firefox tab was crashing (bsc#1170908).

Release notes:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53
_rele ase_notes

mozilla-nspr to version 4.25

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4421-1 advisory.

    Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially     crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of     service, obtain sensitive information, or execute arbtirary code. (CVE-2020-12405, CVE-2020-12406,     CVE-2020-12410, CVE-2020-12417, CVE-2020-12418, CVE-2020-12419, CVE-2020-12420)

    It was discovered that Thunderbird would continue an unencrypted connection when configured to use     STARTTLS for IMAP if the server responded with PREAUTH. A remote attacker could potentially exploit this     to perform a person-in-the-middle attack in order to obtain sensitive information. (CVE-2020-12398)

    It was discovered that NSS showed timing differences when performing DSA signatures. An attacker could     potentially exploit this to obtain private keys using a timing attack. (CVE-2020-12399)

    It was discovered that when performing add-on updates, certificate chains not terminating with built-in     roots were silently rejected. This could result in add-ons becoming outdated. (CVE-2020-12421)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for mozilla-nspr, mozilla-nss fixes the following issues :

mozilla-nss was updated to version 3.53

  - CVE-2020-12399: Fixed a timing attack on DSA signature     generation (bsc#1171978).

  - CVE-2019-17006: Added length checks for cryptographic     primitives (bsc#1159819). Release notes:
    https://developer.mozilla.org/en-US/docs/Mozilla/Project     s/NSS/NSS_3.53_release_notes

mozilla-nspr to version 4.25

This update was imported from the SUSE:SLE-15:Update update project.

The remote host is affected by the vulnerability described in GLSA-202007-49 (Mozilla Network Security Service (NSS): Information disclosure)

    NSS was found to not always perform constant-time operations when       working with DSA key material.
  Impact :

    An attacker may be able to obtain information about a DSA private key.
  Workaround :

    There is no known workaround at this time.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_3280 advisory.

    * nss: UAF in sftk_FreeSession due to improper refcounting (CVE-2019-11756)

    * nss: Check length of inputs for cryptographic primitives (CVE-2019-17006)

    * nss: Side channel vulnerabilities during RSA key generation (CVE-2020-12402)

    * nss: TLS 1.3 HelloRetryRequest downgrade request sets client into invalid state (CVE-2019-17023)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Various vulnerabilities were fixed in nss, the Network Security Service libraries.

CVE-2018-12404

Cache side-channel variant of the Bleichenbacher attack.

CVE-2018-18508

NULL pointer dereference in several CMS functions resulting in a denial of service.

CVE-2019-11719

Out-of-bounds read when importing curve25519 private key.

CVE-2019-11729

Empty or malformed p256-ECDH public keys may trigger a segmentation fault.

CVE-2019-11745

Out-of-bounds write when encrypting with a block cipher.

CVE-2019-17006

Some cryptographic primitives did not check the length of the input text, potentially resulting in overflows.

CVE-2019-17007

Handling of Netscape Certificate Sequences may crash with a NULL dereference leading to a denial of service.

CVE-2020-12399

Force a fixed length for DSA exponentiation.

CVE-2020-6829 CVE-2020-12400

Side channel attack on ECDSA signature generation.

CVE-2020-12401

ECDSA timing attack mitigation bypass.

CVE-2020-12402

Side channel vulnerabilities during RSA key generation.

CVE-2020-12403

CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read.

For Debian 9 stretch, these problems have been fixed in version 2:3.26.2-1.1+deb9u2.

We recommend that you upgrade your nss packages.

For the detailed security status of nss please refer to its security tracker page at: https://security-tracker.debian.org/tracker/nss

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
143400	EulerOS 2.0 SP9 : nss (EulerOS-SA-2020-2487)	Nessus	Huawei Local Security Checks	2020/12/1	2024/2/7	critical
137087	Mozilla Thunderbird < 68.9.0	Nessus	Windows	2020/6/4	2025/11/18	high
137177	Slackware 14.2 / current : mozilla-thunderbird (SSA:2020-156-01)	Nessus	Slackware Local Security Checks	2020/6/5	2024/3/7	high
137179	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Firefox vulnerabilities (USN-4383-1)	Nessus	Ubuntu Local Security Checks	2020/6/5	2024/8/27	high
137417	Debian DLA-2247-1 : thunderbird security update	Nessus	Debian Local Security Checks	2020/6/17	2024/3/7	high
138314	SUSE SLES12 Security Update : mozilla-nspr, mozilla-nss (SUSE-SU-2020:1839-1)	Nessus	SuSE Local Security Checks	2020/7/9	2024/3/1	critical
138326	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : Thunderbird vulnerabilities (USN-4421-1)	Nessus	Ubuntu Local Security Checks	2020/7/9	2024/8/27	high
138700	openSUSE Security Update : mozilla-nspr / mozilla-nss (openSUSE-2020-854)	Nessus	SuSE Local Security Checks	2020/7/20	2024/2/29	critical
138972	GLSA-202007-49 : Mozilla Network Security Service (NSS): Information disclosure	Nessus	Gentoo Local Security Checks	2020/7/27	2020/9/24	medium
359300	Rocky Linux 8 [CIQ] Security Update: nspr / nspr-debuginfo / nspr-debugsource / nspr-devel Multiple Vulnerabilities (crlsa-2020_3280)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
141062	Debian DLA-2388-1 : nss security update	Nessus	Debian Local Security Checks	2020/9/30	2024/2/16	critical

検出

プラグインの検索

critical

high

high

high

high

critical

high

critical

medium

critical

critical