The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-533:01 advisory.

    nspr     NSPR provides platform independence for non-GUI operating system     facilities. These facilities include threads, thread synchronization,     normal file and network I/O, interval timing and calendar time, basic     memory management (malloc and free) and shared library linking.
    nss     Network Security Services (NSS) is a set of libraries designed to     support cross-platform development of security-enabled client and     server applications. Applications built with NSS can support SSL v2     and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509     v3 certificates, and other security standards.
    nss-util     Utilities for Network Security Services and the Softoken module     Security issues fixed with this release:
    CVE-2015-7181
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7182
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7183
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated nss and nspr packages that fix three security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

A use-after-poison flaw and a heap-based buffer overflow flaw were found in the way NSS parsed certain ASN.1 structures. An attacker could use these flaws to cause NSS to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSS library. (CVE-2015-7181, CVE-2015-7182)

A heap-based buffer overflow was found in NSPR. An attacker could use this flaw to cause NSPR to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSPR library. (CVE-2015-7183)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Tyson Smith, David Keeler and Ryan Sleevi as the original reporter.

All nss and nspr users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Updated nss, nss-util, and nspr packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

A use-after-poison flaw and a heap-based buffer overflow flaw were found in the way NSS parsed certain ASN.1 structures. An attacker could use these flaws to cause NSS to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSS library. (CVE-2015-7181, CVE-2015-7182)

A heap-based buffer overflow was found in NSPR. An attacker could use this flaw to cause NSPR to crash or execute arbitrary code with the permissions of the user running an application compiled against the NSPR library. (CVE-2015-7183)

Note: Applications using NSPR's PL_ARENA_ALLOCATE, PR_ARENA_ALLOCATE, PL_ARENA_GROW, or PR_ARENA_GROW macros need to be rebuild against the fixed nspr packages to completely resolve the CVE-2015-7183 issue.
This erratum includes nss and nss-utils packages rebuilt against the fixed nspr version.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Tyson Smith, David Keeler and Ryan Sleevi as the original reporter.

All nss, nss-util and nspr users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1980 advisory.

    - Resolves: Bug 1269359 - CVE-2015-7183

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This Mozilla Firefox, NSS and NSPR update fixes the following security and non security issues.

  - mozilla-nspr was updated to version 4.10.10 (bsc#952810)

  - MFSA 2015-133/CVE-2015-7183 (bmo#1205157) NSPR memory     corruption issues

  - mozilla-nss was updated to 3.19.2.1 (bsc#952810)

  - MFSA 2015-133/CVE-2015-7181/CVE-2015-7182 (bmo#1192028,     bmo#1202868) NSS and NSPR memory corruption issues

  - Mozilla Firefox was updated to 38.4.0 ESR (bsc#952810)

  - MFSA 2015-116/CVE-2015-4513 (bmo#1107011, bmo#1191942,     bmo#1193038, bmo#1204580, bmo#1204669, bmo#1204700,     bmo#1205707, bmo#1206564, bmo#1208665, bmo#1209471,     bmo#1213979) Miscellaneous memory safety hazards     (rv:42.0 / rv:38.4)

  - MFSA 2015-122/CVE-2015-7188 (bmo#1199430) Trailing     whitespace in IP address hostnames can bypass     same-origin policy

  - MFSA 2015-123/CVE-2015-7189 (bmo#1205900) Buffer     overflow during image interactions in canvas

  - MFSA 2015-127/CVE-2015-7193 (bmo#1210302) CORS preflight     is bypassed when non-standard Content-Type headers are     received

  - MFSA 2015-128/CVE-2015-7194 (bmo#1211262) Memory     corruption in libjar through zip files

  - MFSA 2015-130/CVE-2015-7196 (bmo#1140616) JavaScript     garbage collection crash with Java applet

  - MFSA 2015-131/CVE-2015-7198/CVE-2015-7199/CVE-2015-7200     (bmo#1204061, bmo#1188010, bmo#1204155) Vulnerabilities     found through code inspection

  - MFSA 2015-132/CVE-2015-7197 (bmo#1204269) Mixed content     WebSocket policy bypass through workers

  - MFSA 2015-133/CVE-2015-7181/CVE-2015-7182/CVE-2015-7183     (bmo#1202868, bmo#1192028, bmo#1205157) NSS and NSPR     memory corruption issues

  - fix printing on landscape media (bsc#908275)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2819-1 advisory.

    Christian Holler, David Major, Jesse Ruderman, Tyson Smith, Boris Zbarsky, Randell Jesup, Olli Pettay,     Karl Tomlinson, Jeff Walden, and Gary Kwong discovered multiple memory safety issues in Thunderbird. If a     user were tricked in to opening a specially crafted message, an attacker could potentially exploit these     to cause a denial of service via application crash, or execute arbitrary code with the privileges of the     user invoking Thunderbird. (CVE-2015-4513)

    Tyson Smith and David Keeler discovered a use-after-poison and buffer overflow in NSS. An attacker could     potentially exploit these to cause a denial of service via application crash, or execute arbitrary code     with the privileges of the user invoking Thunderbird. (CVE-2015-7181, CVE-2015-7182)

    Ryan Sleevi discovered an integer overflow in NSPR. An attacker could potentially exploit this to cause a     denial of service via application crash, or execute arbitrary code with the privileges of the user     invoking Thunderbird. (CVE-2015-7183)

    Micha Bentkowski discovered that adding white-space to hostnames that are IP addresses can bypass same-     origin protections. If a user were tricked in to opening a specially crafted website in a browser-like     context, an attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks.
    (CVE-2015-7188)

    Looben Yang discovered a buffer overflow during script interactions with the canvas element in some     circumstances. If a user were tricked in to opening a specially crafted website in a browser-like context,     an attacker could potentially exploit this to cause a denial of service via application crash, or execute     arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2015-7189)

    Shinto K Anto discovered that CORS preflight is bypassed when receiving non-standard Content-Type headers     in some circumstances. If a user were tricked in to opening a specially crafted website in a browser-like     context, an attacker could potentially exploit this to bypass same-origin restrictions. (CVE-2015-7193)

    Gustavo Grieco discovered a buffer overflow in libjar in some circumstances. If a user were tricked in to     opening a specially crafted website in a browser-like context, an attacker could potentially exploit this     to cause a denial of service via application crash, or execute arbitrary code with the privileges of the     user invoking Thunderbird. (CVE-2015-7194)

    Ehsan Akhgari discovered a mechanism for a web worker to bypass secure requirements for web sockets. If a     user were tricked in to opening a specially crafted website in a browser-like context, an attacker could     exploit this to bypass the mixed content web socket policy. (CVE-2015-7197)

    Ronald Crane discovered several vulnerabilities through code-inspection. If a user were tricked in to     opening a specially crafted website in a browser-like context, an attacker could potentially exploit these     to cause a denial of service via application crash, or execute arbitrary code with the privileges of the     user invoking Thunderbird. (CVE-2015-7198, CVE-2015-7199, CVE-2015-7200)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201512-10 (Mozilla Products: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Mozilla Firefox and       Mozilla Thunderbird. Please review the CVE identifiers referenced below       for details.
  Impact :

    A remote attacker could entice a user to view a specially crafted web       page or email, possibly resulting in execution of arbitrary code or a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
290127	MiracleLinux 7 : nspr-4.10.8-2.el7, nss-3.19.1-7.el7.2, nss-util-3.19.1-4.el7 (AXSA:2015-533:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
86724	CentOS 5 : nspr / nss (CESA-2015:1980)	Nessus	CentOS Local Security Checks	2015/11/5	2021/1/4	critical
86725	CentOS 6 / 7 : nspr / nss / nss-util (CESA-2015:1981)	Nessus	CentOS Local Security Checks	2015/11/5	2021/1/4	critical
86741	Oracle Linux 5 : nss / and / nspr (ELSA-2015-1980)	Nessus	Oracle Linux Local Security Checks	2015/11/5	2024/10/22	critical
86808	SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2015:1926-1)	Nessus	SuSE Local Security Checks	2015/11/10	2021/1/6	critical
86870	SUSE SLED11 / SLES11 Security Update : MozillaFirefox, mozilla-nspr, mozilla-nss (SUSE-SU-2015:1981-1)	Nessus	SuSE Local Security Checks	2015/11/13	2021/1/6	critical
87168	Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2819-1)	Nessus	Ubuntu Local Security Checks	2015/12/2	2024/8/28	critical
87710	GLSA-201512-10 : Mozilla Products: Multiple vulnerabilities (Bar Mitzvah) (Logjam)	Nessus	Gentoo Local Security Checks	2016/1/4	2022/12/5	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical