—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:252
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : nss
Date : December 15, 2014
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

Updated nss packages fix security vulnerabilities:

In the QuickDER decoder in NSS before 3.17.3, ASN.1 DER decoding of
lengths is too permissive, allowing undetected smuggling of arbitrary
data (CVE-2014-1569).

This update adds support for the TLS Fallback Signaling Cipher Suite
Value (TLS_FALLBACK_SCSV) in NSS, which can be used to prevent protocol
downgrade attacks against applications which re-connect using a lower
SSL/TLS protocol version when the initial connection indicating the
highest supported protocol version fails. This can prevent a forceful
downgrade of the communication to SSL 3.0, mitigating CVE-2014-3566,
also known as POODLE. SSL 3.0 support has also been disabled by
default in this Firefox and Thunderbird update, further mitigating
POODLE.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1569
http://advisories.mageia.org/MGASA-2014-0507.html
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 1/X86_64:
fc10a003360b8afb464df7b305c18127 mbs1/x86_64/lib64nss3-3.17.3-1.mbs1.x86_64.rpm
d905a80bfbca9dfe020ca223b4778e61 mbs1/x86_64/lib64nss-devel-3.17.3-1.mbs1.x86_64.rpm
8fc7041f46189c8c0c89db593ee5da11 mbs1/x86_64/lib64nss-static-devel-3.17.3-1.mbs1.x86_64.rpm
fbdbd1016983804aecd74764b106642b mbs1/x86_64/nss-3.17.3-1.mbs1.x86_64.rpm
7c0c88abd44a83fb87304d677977e183 mbs1/x86_64/nss-doc-3.17.3-1.mbs1.noarch.rpm
ef3f32df47bcf9ced2ecb14b5bcd1439 mbs1/x86_64/rootcerts-20141117.00-1.mbs1.x86_64.rpm
b7b5939180d3f43310e1ee31e11bf087 mbs1/x86_64/rootcerts-java-20141117.00-1.mbs1.x86_64.rpm
cdd11c0294e9c4dc54a896cd3e4c6170 mbs1/SRPMS/nss-3.17.3-1.mbs1.src.rpm
f5e57b2f9ff644f36a26e2c80759accc mbs1/SRPMS/rootcerts-20141117.00-1.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFUjrQDmqjQ0CJFipgRAiUvAJ9meLgw3zNCQfXMfIO4VWcIwFqrKACglVBu
6kKTP01FwHyn4dFFz1WDHRU=
=k8XV
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________