Mageia alert MGASA-2013-0337 (firefox, rootcerts, nspr, and nss)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2013-0337: Updated firefox, rootcerts, nspr & nss packages fix security vulnerabilities 
Date:
    	     
 
Wed, 20 Nov 2013 21:54:54 +0100
Message-ID:
    	     
 
<20131120205454.B02A948C95@valstar.mageia.org>

MGASA-2013-0337 - Updated firefox, rootcerts, nspr & nss packages fix security vulnerabilities

Publication date: 20 Nov 2013
URL: http://advisories.mageia.org/MGASA-2013-0337.html
Type: security
Affected Mageia releases: 2, 3
CVE: CVE-2013-1741,
     CVE-2013-2566,
     CVE-2013-5605,
     CVE-2013-5606,
     CVE-2013-5607

Description:
Updated nspr and nss packages fix security vulnerabilities:

Potentially exploitable buffer overflow in NSS before 3.15.3 that allows
remote attackers to cause a denial of service or possibly have unspecified
other impact via invalid handshake packets (CVE-2013-5605).

The CERT_VerifyCert function in lib/certhigh/certvfy.c in NSS before 3.15.3
provides an unexpected return value for an incompatible key-usage certificate
when the CERTVerifyLog argument is valid, which might allow remote attackers
to bypass intended access restrictions via a crafted certificate
(CVE-2013-5606).

Runaway memset due to an integer truncation in certificate parsing on 64-bit
computers in NSS before 3.15.3 leading to a crash by attempting to write 4Gb
of nulls (CVE-2013-1741).

Integer overflow in NSPR before 4.10.2 due to unsigned integer wrapping in
PL_ArenaAllocate (CVE-2013-5607).

NSS lowered the priority of RC4 in cipher suite advertisement so that more
secure ciphers instead of RC4 are likely to be chosen by the server, because
of plaintext recovery attacks possible with RC4 (CVE-2013-2566).

This also updates to the latest root certificate data from Mozilla.

Additionally, The latest Firefox ESR version, which fixes an issue with
translated strings not being used in some cases, is also being provided.

References:
- https://groups.google.com/forum/#!topic/mozilla.dev.tech....
- https://developer.mozilla.org/en-US/docs/NSS/NSS_3.15.3_r...
- http://www.mozilla.org/security/announce/2013/mfsa2013-10...
- https://bugzilla.mozilla.org/show_bug.cgi?id=932310
- https://www.mozilla.org/en-US/firefox/24.1.1/releasenotes/
- https://bugs.mageia.org/show_bug.cgi?id=11669
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1741
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2566
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5605
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5606
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5607

SRPMS:
- 3/core/rootcerts-20131111.00-1.mga3
- 3/core/nspr-4.10.2-1.mga3
- 3/core/nss-3.15.3-1.mga3
- 3/core/firefox-24.1.1-1.mga3
- 3/core/firefox-l10n-24.1.1-1.mga3
- 2/core/rootcerts-20131111.00-1.mga2
- 2/core/nspr-4.10.2-1.mga2
- 2/core/nss-3.15.3-1.mga2
- 2/core/firefox-24.1.1-1.mga2
- 2/core/firefox-l10n-24.1.1-1.mga2