Test ID:	1.3.6.1.4.1.25623.1.1.10.2014.0507
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2014-0507)
Summary:	The remote host is missing an update for the 'firefox, firefox-l10n, nss, rootcerts, thunderbird, thunderbird-l10n' package(s) announced via the MGASA-2014-0507 advisory.
Description:	Summary: The remote host is missing an update for the 'firefox, firefox-l10n, nss, rootcerts, thunderbird, thunderbird-l10n' package(s) announced via the MGASA-2014-0507 advisory. Vulnerability Insight: Updated nss, firefox, and thunderbird packages fix security vulnerabilities: In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of lengths is too permissive, allowing undetected smuggling of arbitrary data (CVE-2014-1569). Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running it (CVE-2014-1587, CVE-2014-1590, CVE-2014-1592, CVE-2014-1593). A flaw was found in the Alarm API, which could allow applications to schedule actions to be run in the future. A malicious web application could use this flaw to bypass the same-origin policy (CVE-2014-1594). This update adds support for the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol downgrade attacks against applications which re-connect using a lower SSL/TLS protocol version when the initial connection indicating the highest supported protocol version fails. This can prevent a forceful downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566, also known as POODLE. SSL 3.0 support has also been disabled by default in this Firefox and Thunderbird update, further mitigating POODLE. Affected Software/OS: 'firefox, firefox-l10n, nss, rootcerts, thunderbird, thunderbird-l10n' package(s) on Mageia 4. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-1569 Debian Security Information: DSA-3186 (Google Search) http://www.debian.org/security/2015/dsa-3186 http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf https://www.imperialviolet.org/2014/09/26/pkcs1.html https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02 http://www.securitytracker.com/id/1032909 SuSE Security Announcement: SUSE-SU-2015:0171 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html SuSE Security Announcement: SUSE-SU-2015:0173 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html SuSE Security Announcement: SUSE-SU-2015:0180 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html SuSE Security Announcement: openSUSE-SU-2015:0138 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html SuSE Security Announcement: openSUSE-SU-2015:0404 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html Common Vulnerability Exposure (CVE) ID: CVE-2014-1587 BugTraq ID: 71391 http://www.securityfocus.com/bid/71391 Debian Security Information: DSA-3090 (Google Search) http://www.debian.org/security/2014/dsa-3090 Debian Security Information: DSA-3092 (Google Search) http://www.debian.org/security/2014/dsa-3092 https://security.gentoo.org/glsa/201504-01 SuSE Security Announcement: openSUSE-SU-2015:1266 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html Common Vulnerability Exposure (CVE) ID: CVE-2014-1590 BugTraq ID: 71397 http://www.securityfocus.com/bid/71397 Common Vulnerability Exposure (CVE) ID: CVE-2014-1592 BugTraq ID: 71398 http://www.securityfocus.com/bid/71398 Common Vulnerability Exposure (CVE) ID: CVE-2014-1593 BugTraq ID: 71395 http://www.securityfocus.com/bid/71395 Common Vulnerability Exposure (CVE) ID: CVE-2014-1594 BugTraq ID: 71396 http://www.securityfocus.com/bid/71396
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.