Most recent entries from all

ALSA-2021:4903 — Critical: nss security update

Affected: AlmaLinux:8: nss, AlmaLinux:8: nss-devel, AlmaLinux:8: nss-softokn, AlmaLinux:8: nss-softokn-devel, AlmaLinux:8: nss-softokn-freebl, AlmaLinux:8: nss-softokn-freebl-devel, AlmaLinux:8: nss-sysinit, AlmaLinux:8: nss-tools, AlmaLinux:8: nss-util, AlmaLinux:8: nss-util-devel

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es):

* nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS) (CVE-2021-43527)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2022-00002

Withdrawn: BELL-CVE-2021-43527 — CVE-2021-43527 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2021-avi-915 — Une vulnérabilité a été découverte dans Red Hat. Elle permet à un attaquant de provoquer une exécution de code arbitrai…

certfr-2021-avi-915

cnvd-2021-102398

EUVD-2026-32527

fkie_cve-2021-43527

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

GHSA-7hfm-39v6-v3p5

gsd-2021-43527

ICSA-24-102-04 — Siemens RUGGEDCOM APE1808

The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string. PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a long string because of an Integer overflow in mysqli_real_escape_string. It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA. In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits. NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validat…

msrc_CVE-2021-43527 — NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DE…

msrc_CVE-2021-43527

OESA-2022-1492 — nss security update

Affected: openEuler:20.03-LTS-SP1: nss, openEuler:20.03-LTS-SP2: nss, openEuler:20.03-LTS-SP3: nss

Network Security Services. Security Fix(es): NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.(CVE-2021-43527)

openSUSE-SU-2021:3934-1 — Security update for mozilla-nss

Security update for mozilla-nss

RHSA-2021:4907 — Red Hat Security Advisory: nss security update

nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)

SUSE-SU-2021:14858-1 — Security update for mozilla-nss

Security update for mozilla-nss

UBUNTU-CVE-2021-43527

Affected: Ubuntu:Pro:14.04:LTS: nss, Ubuntu:Pro:16.04:LTS: nss, Ubuntu:18.04:LTS: nss, Ubuntu:18.04:LTS: thunderbird, Ubuntu:20.04:LTS: nss, Ubuntu:20.04:LTS: thunderbird, Ubuntu:22.04:LTS: nss, Ubuntu:22.04:LTS: thunderbird

WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.