Univention Bugzilla – Bug 42858
nss: Multiple issues (4.1)
Last modified: 2017-07-05 13:32:17 CEST
Upstream Debian package has bee updated to version 2:3.26-1+debu7u1 which fixes:
The Network Security Service (NSS) libraries uses environment variables to configure lots of things, some of which refer to file system locations. Others can be degrade the operation of NSS in various ways, forcing compatibility modes and so on.
Previously, these environment variables were not ignored SUID binaries. This version of NetScape Portable Runtime Library (NSPR) introduce a new API, PR_GetEnVSecure, to address this.
Both NSPR and NSS need to be upgraded to address this problem.
nss (2:3.26-1+debu7u2) wheezy-security
* CVE-2016-9074: existing mitigation of timing side-channel attacks insufficient
Upstream Debian package version 2:3.26-1+debu7u3 fixes:
* Out-of-bounds write in Base64 encoding. This can trigger a crash (denial of service) and might be exploitable for code execution (CVE-2017-5461)
* A flaw in DRBG number generation where the internal state V does not correctly carry bits over (CVE-2017-5462)
Mozilla Network Security Service (nss) is used by openjdk-7-jre-headless and libreoffice-core, e.g.
Upstream package imported and built in errata4.1-4.
Upstream Debian package version 2:3.26-1+debu7u4 fixes:
* Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker (CVE-2017-7502)
Package rebuilt with patch, advisory updated.
Tests (amd64): OK