GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

SUSE-SU-2016:2285-1

Vulnerability from csaf_suse - Published: 2016-09-10 10:52 - Updated: 2016-09-10 10:52
Summary
Security update for apache2-mod_nss
Severity
Moderate
Notes
Title of the patch: Security update for apache2-mod_nss
Description of the patch: This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements: - Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099) - Created valgrind suppression files to ease debugging. - Implement SSL_PPTYPE_FILTER to call executables to get the key password pins. - Improvements to migrate.pl. - Update default ciphers to something more modern and secure. - Check for host and netstat commands in gencert before trying to use them. - Add server support for DHE ciphers. - Extract SAN from server/client certificates into env - Fix memory leaks and other coding issues caught by clang analyzer. - Add support for Server Name Indication (SNI). - Add support for SNI for reverse proxy connections. - Add RenegBufferSize? option. - Add support for TLS Session Tickets (RFC 5077). - Fix logical AND support in OpenSSL cipher compatibility. - Correctly handle disabled ciphers. (CVE-2015-5244) - Implement a slew more OpenSSL cipher macros. - Fix a number of illegal memory accesses and memory leaks. - Support for SHA384 ciphers if they are available in NSS. - Add compatibility for mod_ssl-style cipher definitions. - Add TLSv1.2-specific ciphers. - Completely remove support for SSLv2. - Add support for sqlite NSS databases. - Compare subject CN and VS hostname during server start up. - Add support for enabling TLS v1.2. - Don't enable SSL 3 by default. (CVE-2014-3566) - Fix CVE-2013-4566. - Move nss_pcache to /usr/libexec. - Support httpd 2.4+. - Use apache2-systemd-ask-pass to prompt for a certificate passphrase. (bsc#972968, bsc#975394)
Patchnames: SUSE-SLE-SERVER-12-SP1-2016-1335
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2013-4566
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2014-3566
3.4 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Affected products
Recommended 6 products, the same list as for CVE-2013-4566
Threats
Impact critical
CVE-2015-5244
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 6 products, the same list as for CVE-2013-4566
Threats
Impact critical
CVE-2016-3099
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Recommended 6 products, the same list as for CVE-2013-4566
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/s… self
https://www.suse.com/support/update/announcement/… self
https://lists.suse.com/pipermail/sle-security-upd… self
https://bugzilla.suse.com/972968 self
https://bugzilla.suse.com/975394 self
https://bugzilla.suse.com/979688 self
https://www.suse.com/security/cve/CVE-2013-4566/ self
https://www.suse.com/security/cve/CVE-2014-3566/ self
https://www.suse.com/security/cve/CVE-2015-5244/ self
https://www.suse.com/security/cve/CVE-2016-3099/ self
https://www.suse.com/security/cve/CVE-2013-4566 external
https://bugzilla.suse.com/853039 external
https://www.suse.com/security/cve/CVE-2014-3566 external
https://bugzilla.suse.com/1011293 external
https://bugzilla.suse.com/1031023 external
https://bugzilla.suse.com/901223 external
https://bugzilla.suse.com/901254 external
https://bugzilla.suse.com/901277 external
https://bugzilla.suse.com/901748 external
https://bugzilla.suse.com/901757 external
https://bugzilla.suse.com/901759 external
https://bugzilla.suse.com/901889 external
https://bugzilla.suse.com/901968 external
https://bugzilla.suse.com/902229 external
https://bugzilla.suse.com/902233 external
https://bugzilla.suse.com/902476 external
https://bugzilla.suse.com/903405 external
https://bugzilla.suse.com/903684 external
https://bugzilla.suse.com/904889 external
https://bugzilla.suse.com/905106 external
https://bugzilla.suse.com/914041 external
https://bugzilla.suse.com/994144 external
https://www.suse.com/security/cve/CVE-2015-5244 external
https://bugzilla.suse.com/945905 external
https://www.suse.com/security/cve/CVE-2016-3099 external
https://bugzilla.suse.com/973996 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for apache2-mod_nss",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update provides apache2-mod_nss 1.0.14, which brings several fixes and\nenhancements:\n\n- Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099)\n- Created valgrind suppression files to ease debugging.\n- Implement SSL_PPTYPE_FILTER to call executables to get the key password pins.\n- Improvements to migrate.pl.\n- Update default ciphers to something more modern and secure.\n- Check for host and netstat commands in gencert before trying to use them.\n- Add server support for DHE ciphers.\n- Extract SAN from server/client certificates into env\n- Fix memory leaks and other coding issues caught by clang analyzer.\n- Add support for Server Name Indication (SNI).\n- Add support for SNI for reverse proxy connections.\n- Add RenegBufferSize? option.\n- Add support for TLS Session Tickets (RFC 5077).\n- Fix logical AND support in OpenSSL cipher compatibility.\n- Correctly handle disabled ciphers. (CVE-2015-5244)\n- Implement a slew more OpenSSL cipher macros.\n- Fix a number of illegal memory accesses and memory leaks.\n- Support for SHA384 ciphers if they are available in NSS.\n- Add compatibility for mod_ssl-style cipher definitions.\n- Add TLSv1.2-specific ciphers.\n- Completely remove support for SSLv2.\n- Add support for sqlite NSS databases.\n- Compare subject CN and VS hostname during server start up.\n- Add support for enabling TLS v1.2.\n- Don\u0027t enable SSL 3 by default. (CVE-2014-3566)\n- Fix CVE-2013-4566.\n- Move nss_pcache to /usr/libexec.\n- Support httpd 2.4+.\n- Use apache2-systemd-ask-pass to prompt for a certificate passphrase.\n  (bsc#972968, bsc#975394)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-SERVER-12-SP1-2016-1335",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_2285-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2016:2285-1",
        "url": "https://www.suse.com/support/update/announcement/2016/suse-su-20162285-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2016:2285-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2016-September/002267.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 972968",
        "url": "https://bugzilla.suse.com/972968"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 975394",
        "url": "https://bugzilla.suse.com/975394"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 979688",
        "url": "https://bugzilla.suse.com/979688"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-4566 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-4566/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-3566 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-3566/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2015-5244 page",
        "url": "https://www.suse.com/security/cve/CVE-2015-5244/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-3099 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-3099/"
      }
    ],
    "title": "Security update for apache2-mod_nss",
    "tracking": {
      "current_release_date": "2016-09-10T10:52:38Z",
      "generator": {
        "date": "2016-09-10T10:52:38Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2016:2285-1",
      "initial_release_date": "2016-09-10T10:52:38Z",
      "revision_history": [
        {
          "date": "2016-09-10T10:52:38Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-mod_nss-1.0.14-18.3.ppc64le",
                "product": {
                  "name": "apache2-mod_nss-1.0.14-18.3.ppc64le",
                  "product_id": "apache2-mod_nss-1.0.14-18.3.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-mod_nss-1.0.14-18.3.s390x",
                "product": {
                  "name": "apache2-mod_nss-1.0.14-18.3.s390x",
                  "product_id": "apache2-mod_nss-1.0.14-18.3.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "apache2-mod_nss-1.0.14-18.3.x86_64",
                "product": {
                  "name": "apache2-mod_nss-1.0.14-18.3.x86_64",
                  "product_id": "apache2-mod_nss-1.0.14-18.3.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP1",
                  "product_id": "SUSE Linux Enterprise Server 12 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp1"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-mod_nss-1.0.14-18.3.ppc64le as component of SUSE Linux Enterprise Server 12 SP1",
          "product_id": "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le"
        },
        "product_reference": "apache2-mod_nss-1.0.14-18.3.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-mod_nss-1.0.14-18.3.s390x as component of SUSE Linux Enterprise Server 12 SP1",
          "product_id": "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x"
        },
        "product_reference": "apache2-mod_nss-1.0.14-18.3.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-mod_nss-1.0.14-18.3.x86_64 as component of SUSE Linux Enterprise Server 12 SP1",
          "product_id": "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
        },
        "product_reference": "apache2-mod_nss-1.0.14-18.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-mod_nss-1.0.14-18.3.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le"
        },
        "product_reference": "apache2-mod_nss-1.0.14-18.3.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-mod_nss-1.0.14-18.3.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x"
        },
        "product_reference": "apache2-mod_nss-1.0.14-18.3.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "apache2-mod_nss-1.0.14-18.3.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
        },
        "product_reference": "apache2-mod_nss-1.0.14-18.3.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2013-4566",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-4566"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-4566",
          "url": "https://www.suse.com/security/cve/CVE-2013-4566"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 853039 for CVE-2013-4566",
          "url": "https://bugzilla.suse.com/853039"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-09-10T10:52:38Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2013-4566"
    },
    {
      "cve": "CVE-2014-3566",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-3566"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the \"POODLE\" issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-3566",
          "url": "https://www.suse.com/security/cve/CVE-2014-3566"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1011293 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/1011293"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1031023 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/1031023"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901223 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/901223"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901254 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/901254"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901277 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/901277"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901748 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/901748"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901757 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/901757"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901759 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/901759"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901889 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/901889"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 901968 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/901968"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 902229 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/902229"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 902233 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/902233"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 902476 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/902476"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 903405 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/903405"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 903684 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/903684"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 904889 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/904889"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 905106 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/905106"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 914041 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/914041"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 994144 for CVE-2014-3566",
          "url": "https://bugzilla.suse.com/994144"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-09-10T10:52:38Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2014-3566"
    },
    {
      "cve": "CVE-2015-5244",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2015-5244"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2015-5244",
          "url": "https://www.suse.com/security/cve/CVE-2015-5244"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 945905 for CVE-2015-5244",
          "url": "https://bugzilla.suse.com/945905"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-09-10T10:52:38Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2015-5244"
    },
    {
      "cve": "CVE-2016-3099",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-3099"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "mod_ns in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux Workstation 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
          "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-3099",
          "url": "https://www.suse.com/security/cve/CVE-2016-3099"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 973996 for CVE-2016-3099",
          "url": "https://bugzilla.suse.com/973996"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-mod_nss-1.0.14-18.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-09-10T10:52:38Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-3099"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.