libfreebl3mozilla-nss: Security update to 3.12.3.1mozilla-nss: Security update to 3.12.3.1The Mozilla NSS and dependend libraries were updated to fix
various issues.
CVE-2009-2404 / MFSA 2009-43 : Heap-based buffer overflow
in a regular-expression parser in Mozilla Network Security
Services (NSS) before 3.12.3, as used in Firefox,
Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant
Messenger (AIM), allows remote SSL servers to cause a
denial of service (application crash) or possibly execute
arbitrary code via a long domain name in the subject's
Common Name (CN) field of an X.509 certificate, related to
the cert_TestHostName function.
MFSA 2009-42 / CVE-2009-2408: IOActive security researcher
Dan Kaminsky reported a mismatch in the treatment of domain
names in SSL certificates between SSL clients and the
Certificate Authorities (CA) which issue server
certificates. In particular, if a malicious person
requested a certificate for a host name with an invalid
null character in it most CAs would issue the certificate
if the requester owned the domain specified after the null,
while most SSL clients (browsers) ignored that part of the
name and used the unvalidated part in front of the null.
This made it possible for attackers to obtain certificates
that would function for any site they wished to target.
These certificates could be used to intercept and
potentially alter encrypted communication between the
client and a server such as sensitive bank account
transactions. This vulnerability was independently reported
to us by researcher Moxie Marlinspike who also noted that
since Firefox relies on SSL to protect the integrity of
security updates this attack could be used to serve
malicious updates.
The Mozilla NSS and dependend libraries were updated to fix
various issues.
CVE-2009-2404 / MFSA 2009-43 : Heap-based buffer overflow
in a regular-expression parser in Mozilla Network Security
Services (NSS) before 3.12.3, as used in Firefox,
Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant
Messenger (AIM), allows remote SSL servers to cause a
denial of service (application crash) or possibly execute
arbitrary code via a long domain name in the subject's
Common Name (CN) field of an X.509 certificate, related to
the cert_TestHostName function.
MFSA 2009-42 / CVE-2009-2408: IOActive security researcher
Dan Kaminsky reported a mismatch in the treatment of domain
names in SSL certificates between SSL clients and the
Certificate Authorities (CA) which issue server
certificates. In particular, if a malicious person
requested a certificate for a host name with an invalid
null character in it most CAs would issue the certificate
if the requester owned the domain specified after the null,
while most SSL clients (browsers) ignored that part of the
name and used the unvalidated part in front of the null.
This made it possible for attackers to obtain certificates
that would function for any site they wished to target.
These certificates could be used to intercept and
potentially alter encrypted communication between the
client and a server such as sensitive bank account
transactions. This vulnerability was independently reported
to us by researcher Moxie Marlinspike who also noted that
since Firefox relies on SSL to protect the integrity of
security updates this attack could be used to serve
malicious updates.
securitylibfreebl3i58690410a09860726fd5b7550ad5da5452b96f30439libfreebl3ppca2cc29c7dba06eddede3e0b4fed9526cdd07a1f3libfreebl3x86_64bf0203a7f68a502f3edf764f6af9ec4c897a36b6libfreebl3-32bitx86_647100932b3df0948f1923f1c4c0217057841391a1libfreebl3-64bitppc79c3f8a498e79c3f9ca7b0cf0aab495ea72dd0f1mozilla-nspri586d0924936ef54f482069b1ab76c64f3cf4875102dbdfe9b209ba31edda9d0cae9c0431c9bf1db5d63mozilla-nsprppc8b74162ab9464b5caff8715099c780dc29c299eefcb4f37e27884c6c17196a05f1e7de5d18359ac0mozilla-nsprx86_64f2c12ca171125d20e8f8903c0cba174538d802f560f57551209c7646b36abb2126cd39be4bb6535fmozilla-nspr-32bitx86_6473925df880aad4fb9724151575e907e595dbc0801c5af819236db1a89d301176aa4f0414b67fab69mozilla-nspr-64bitppc6433a1e69205b4603d3a25403e3198ed79fcd119mozilla-nspr-develi5860627341be1c0236bce23a14c997907c9abfa11bcc7f9250610a679e60d2a88b89f13e88bbfed8beemozilla-nspr-develppc53e4e8b0e0263e304604f9e44109f4e0e6e22bc351ce32d26a6a6bdae46c58be5efd84c6205625ccmozilla-nspr-develx86_647d0c45284b1743321c7f390bc5cc6b2877547a61fb8027fc6e8fc1b849993b6ca4130e15c43a381dmozilla-nssi5861a826cf72e1da86d632eaf5ae645408a2622187a24bb4e78e9d98ad9bb78ec7304c1230ca85948e9mozilla-nssppcd0379a2f7ab4bca4d7c7493799aede6f5356f6dff6bac47fb7cc11fd6f91162463ac64885c502eedmozilla-nssx86_648540773e98d04f5ad1c2e2cb46f3b6bafdcc262b96d4d5b554b4059d91f79d0037146e5382484c4emozilla-nss-32bitx86_64a9d484ad6e55a624e1eba6262a42e7977efb4b7d5e5a4c03af201cfa5eddb9246c95437fcf49eb39mozilla-nss-64bitppceae2601cdf96c1aa42230c0c4f65fc72424b2058mozilla-nss-develi586142caeb19f72edb7093768e2e2f4da2d9727b4fb631f177c5a0edf83349998fc584d75cb2e5ef334mozilla-nss-develppc9f22177777efb27e82c2d586a8fef603d60a3ef2126dc92ca60b3e91eacd8d5e6cb72a590a95c11amozilla-nss-develx86_647d1af9e96adfb68b8995d70980f66ea54c084d9a78ca82af674409ae952baaafda2c4984f44ae54amozilla-nss-toolsi586402aa5c17a1fa83dfc074782725d98a3e4b35eabmozilla-nss-toolsppce806ab3b6bf5d9601ef1b9943ce84c25679e8a21mozilla-nss-toolsx86_64aac50eba6630f332dd6f2f818cd3ba75fb7df707