CVE-2017-7502
Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.
- Auf 2:3.28.4-0ubuntu0.16.04.2 aktualisieren
Veröffentlicht Aktualisiert
PatchFirst · Aktuelle Sicherheitslücken
Sicherheitslücken in nss · Seite 2
In den letzten 30 Tagen veröffentlichte Sicherheitslücken für nss: 0. Davon im KEV-Katalog: 0.
Sicherheitslücken: 26
CVE-2017-5461
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.
- Auf 2:3.28.4-0ubuntu0.16.04.1 aktualisieren
Veröffentlicht AktualisiertCVE-2016-2183
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
- Auf 2:3.28.4-0ubuntu0.16.04.1 aktualisieren
Veröffentlicht AktualisiertCVE-2016-2834
Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
- Auf 2:3.23-0ubuntu0.16.04.1 aktualisieren
Veröffentlicht AktualisiertCVE-2016-1950
Heap-based buffer overflow in Mozilla Network Security Services (NSS) before 3.19.2.3 and 3.20.x and 3.21.x before 3.21.1, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to execute arbitrary code via crafted ASN.1 data in an X.509 certificate.
- Auf 2:3.21-1ubuntu4 aktualisieren
Veröffentlicht AktualisiertCVE-2015-4000
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.
- Auf 2:3.19.2-1ubuntu1 aktualisieren
Veröffentlicht Aktualisiert
Prüfen Sie Ihren Server
Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.