You are here
Home > Preporuke > Sigurnosni propust programskog paketa nss

Sigurnosni propust programskog paketa nss

  • Detalji os-a: LMV
  • Važnost: IMP
  • Operativni sustavi: L
  • Kategorije: LMV

Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2014:252

Package : nss
Date : December 15, 2014
Affected: Business Server 1.0

Problem Description:

Updated nss packages fix security vulnerabilities:

In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of
lengths is too permissive, allowing undetected smuggling of arbitrary
data (CVE-2014-1569).

This update adds support for the TLS Fallback Signaling Cipher Suite
Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol
downgrade attacks against applications which re-connect using a lower
SSL/TLS protocol version when the initial connection indicating the
highest supported protocol version fails. This can prevent a forceful
downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566,
also known as POODLE. SSL 3.0 support has also been disabled by
default in this Firefox and Thunderbird update, further mitigating


Updated Packages:

Mandriva Business Server 1/X86_64:
fc10a003360b8afb464df7b305c18127 mbs1/x86_64/lib64nss3-3.17.3-1.mbs1.x86_64.rpm
d905a80bfbca9dfe020ca223b4778e61 mbs1/x86_64/lib64nss-devel-3.17.3-1.mbs1.x86_64.rpm
8fc7041f46189c8c0c89db593ee5da11 mbs1/x86_64/lib64nss-static-devel-3.17.3-1.mbs1.x86_64.rpm
fbdbd1016983804aecd74764b106642b mbs1/x86_64/nss-3.17.3-1.mbs1.x86_64.rpm
7c0c88abd44a83fb87304d677977e183 mbs1/x86_64/nss-doc-3.17.3-1.mbs1.noarch.rpm
ef3f32df47bcf9ced2ecb14b5bcd1439 mbs1/x86_64/rootcerts-20141117.00-1.mbs1.x86_64.rpm
b7b5939180d3f43310e1ee31e11bf087 mbs1/x86_64/rootcerts-java-20141117.00-1.mbs1.x86_64.rpm
cdd11c0294e9c4dc54a896cd3e4c6170 mbs1/SRPMS/nss-3.17.3-1.mbs1.src.rpm
f5e57b2f9ff644f36a26e2c80759accc mbs1/SRPMS/rootcerts-20141117.00-1.mbs1.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver 0x22458A98

You can view other update advisories for Mandriva Linux at:

If you want to report vulnerabilities, please contact


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.12 (GNU/Linux)


To unsubscribe, send a email to
with this subject : unsubscribe security-announce
Want to buy your Pack or Services from Mandriva?
Go to

AutorTomislav Protega
Cert idNCERT-REF-2014-12-0056-ADV
CveCVE-2014-1569 CVE-2014-3566
ID izvornikaMDVSA-2014:252
More in Preporuke
Ranjivost programskog paketa firebird

Otkrivena je ranjivost u poslužitelju Firebird za openSUSE uzrokovana pokušajem pristupanja memorijskoj lokaciji kojoj nije dopušten pristup prilikom obrade posebno...