![]() ![]() Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. ![]() NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root. The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide ".enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. When the candidate has been publicized, the details for this candidate will be provided. ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. ![]()
0 Comments
Leave a Reply. |