178 lines
7.6 KiB
JSON
178 lines
7.6 KiB
JSON
{
|
|
"Definition": [
|
|
{
|
|
"ID": "oval:org.altlinux.errata:def:20141618",
|
|
"Version": "oval:org.altlinux.errata:def:20141618",
|
|
"Class": "patch",
|
|
"Metadata": {
|
|
"Title": "ALT-PU-2014-1618: package `nss` update to version 3.16.1-alt1",
|
|
"AffectedList": [
|
|
{
|
|
"Family": "unix",
|
|
"Platforms": [
|
|
"ALT Linux branch c9f2"
|
|
],
|
|
"Products": [
|
|
"ALT SPWorkstation",
|
|
"ALT SPServer"
|
|
]
|
|
}
|
|
],
|
|
"References": [
|
|
{
|
|
"RefID": "ALT-PU-2014-1618",
|
|
"RefURL": "https://errata.altlinux.org/ALT-PU-2014-1618",
|
|
"Source": "ALTPU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00420",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00420",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00431",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00431",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00460",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00460",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00680",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00680",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00701",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00701",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-1492",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-1492",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-1544",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-1544",
|
|
"Source": "CVE"
|
|
}
|
|
],
|
|
"Description": "This update upgrades nss to version 3.16.1-alt1. \nSecurity Fix(es):\n\n * BDU:2015-00420: Уязвимость браузера Firefox, позволяющая удаленному злоумышленнику нарушить целостность защищаемой информации\n\n * BDU:2015-00431: Уязвимость браузера Firefox, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2015-00460: Уязвимость программного обеспечения Firefox ESR, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2015-00680: Уязвимость программного обеспечения SeaMonkey, позволяющая удаленному злоумышленнику нарушить защищаемой информации\n\n * BDU:2015-00701: Уязвимость программного обеспечения Thunderbird, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * CVE-2014-1492: The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.\n\n * CVE-2014-1544: Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.",
|
|
"Advisory": {
|
|
"From": "errata.altlinux.org",
|
|
"Severity": "Critical",
|
|
"Rights": "Copyright 2024 BaseALT Ltd.",
|
|
"Issued": {
|
|
"Date": "2014-05-13"
|
|
},
|
|
"Updated": {
|
|
"Date": "2014-05-13"
|
|
},
|
|
"BDUs": [
|
|
{
|
|
"ID": "BDU:2015-00420",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"CWE": "CWE-20",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00420",
|
|
"Impact": "Low",
|
|
"Public": "20140430"
|
|
},
|
|
{
|
|
"ID": "BDU:2015-00431",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-416",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00431",
|
|
"Impact": "Critical",
|
|
"Public": "20140723"
|
|
},
|
|
{
|
|
"ID": "BDU:2015-00460",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00460",
|
|
"Impact": "Critical",
|
|
"Public": "20140723"
|
|
},
|
|
{
|
|
"ID": "BDU:2015-00680",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"CWE": "CWE-20",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00680",
|
|
"Impact": "Low",
|
|
"Public": "20140430"
|
|
},
|
|
{
|
|
"ID": "BDU:2015-00701",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00701",
|
|
"Impact": "Critical",
|
|
"Public": "20140723"
|
|
}
|
|
],
|
|
"CVEs": [
|
|
{
|
|
"ID": "CVE-2014-1492",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"CWE": "CWE-20",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-1492",
|
|
"Impact": "Low",
|
|
"Public": "20140325"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-1544",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-1544",
|
|
"Impact": "Critical",
|
|
"Public": "20140723"
|
|
}
|
|
],
|
|
"AffectedCPEs": {
|
|
"CPEs": [
|
|
"cpe:/o:alt:spworkstation:8.4",
|
|
"cpe:/o:alt:spserver:8.4"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"Criteria": {
|
|
"Operator": "AND",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:3001",
|
|
"Comment": "ALT Linux must be installed"
|
|
}
|
|
],
|
|
"Criterias": [
|
|
{
|
|
"Operator": "OR",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20141618001",
|
|
"Comment": "libnss is earlier than 0:3.16.1-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20141618002",
|
|
"Comment": "libnss-devel is earlier than 0:3.16.1-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20141618003",
|
|
"Comment": "libnss-devel-static is earlier than 0:3.16.1-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20141618004",
|
|
"Comment": "libnss-sysinit is earlier than 0:3.16.1-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20141618005",
|
|
"Comment": "nss-utils is earlier than 0:3.16.1-alt1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
} |