The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Vulnerability of NSPR: memory corruptions

Synthesis of the vulnerability

An attacker can use two vulnerabilities of NSPR, in order to generate a denial of service, or to execute code.
Severity of this weakness: 2/4.
Number of vulnerabilities in this bulletin: 2.
Creation date: 02/11/2009.
Références of this bulletin: 492779, 516396, BID-36851, CERTA-2009-AVI-414, CERTA-2009-AVI-509, CERTA-2009-AVI-520, CERTA-2010-AVI-280, CVE-2009-0689, CVE-2009-1563-REJECT, DSA-1931-1, FEDORA-2010-7100, MDVSA-2009:294, SUSE-SR:2009:018, VIGILANCE-VUL-9144, VMSA-2010-0001, VMSA-2010-0001.1.

Description of the vulnerability

The NSPR (Netscape Portable Runtime) library is impacted by two vulnerabilities.

An attacker can corrupt the memory when a string is converted to a float number, which leads to code execution. [severity:2/4; 516396, BID-36851, CERTA-2009-AVI-414, CERTA-2009-AVI-509, CERTA-2009-AVI-520, CERTA-2010-AVI-280, CVE-2009-0689, CVE-2009-1563-REJECT]

With NSPR 4.8, an attacker can generate an integer overflow in the PL_Base64Decode() function. [severity:2/4; 492779]

An attacker can therefore generate a denial of service, or execute code, in applications linked to NSPR.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

This security bulletin impacts software or systems such as Debian, Fedora, Mandriva Linux, NSPR, openSUSE, SLES, ESX.

Our Vigil@nce team determined that the severity of this cybersecurity announce is medium.

The trust level is of type confirmed by the editor, with an origin of document.

This bulletin is about 2 vulnerabilities.

An attacker with a expert ability can exploit this vulnerability alert.

Solutions for this threat

NSPR: version 4.8.2.
Version 4.8.2 is corrected:
  http://www.mozilla.org/projects/nspr/

NSPR: version 4.7.6.
Version 4.7.6 is corrected:
  http://www.mozilla.org/projects/nspr/

Debian: new NSPR packages.
New packages are available:
  http://security.debian.org/pool/updates/main/n/nspr/libnspr4-0*_4.7.1-5_*.deb

Fedora 11: new seamonkey packages.
New packages are available:
  seamonkey-1.1.19-1.fc11

Mandriva 2010.0: new firefox packages.
New packages are available, as indicated in information sources.

SUSE: new packages (12/11/2009).
New packages are available, as indicated in information sources.

VMware ESX 4.0: patch for nss/nspr.
A patch is available:
ESX400-200912403-SG
https://hostupdate.vmware.com/software/VUM/OFFLINE/release-181-20091231-153046/ESX400-200912001.zip
md5sum: 78c6cf139b7941dc736c9d3a41deae77
sha1sum: 36df3a675fbd3c8c8830f00637e37ee716bdac59
http://kb.vmware.com/kb/1016293
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)

Computer vulnerabilities tracking service

Vigil@nce provides applications vulnerabilities patches. Each administrator can customize the list of products for which he wants to receive vulnerability alerts.