Bug 42858 – nss: Multiple issues (4.1)

Bug 42858 - nss: Multiple issues (4.1)


Summary:	nss: Multiple issues (4.1)

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	Security updates
Version:	UCS 4.1
Hardware:	Other Linux

Importance:	P2 normal (vote)
Target Milestone:	UCS 4.1-4-errata
Assigned To:	Arvid Requate
QA Contact:	Janek Walkenhorst

URL:
Keywords:

Depends on:	41565 44777
Blocks:	41334
	Show dependency tree / graph

Reported:	2016-11-05 20:49 CET by Arvid Requate
Modified:	2017-07-05 13:32 CEST (History)
CC List:	2 users (show)

See Also:	41565
What kind of report is it?:	Security Issue
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	Security
Max CVSS v3 score:	9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Flags:	requate: Patch_Available+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2016-11-05 20:49:14 CET

Upstream Debian package has bee updated to version 2:3.26-1+debu7u1 which fixes:


The Network Security Service (NSS) libraries uses environment variables to configure lots of things, some of which refer to file system locations. Others can be degrade the operation of NSS in various ways, forcing compatibility modes and so on.

Previously, these environment variables were not ignored SUID binaries. This version of NetScape Portable Runtime Library (NSPR) introduce a new API, PR_GetEnVSecure, to address this.

Both NSPR and NSS need to be upgraded to address this problem.

Comment 1 Janek Walkenhorst

2017-01-17 16:51:31 CET

nss (2:3.26-1+debu7u2) wheezy-security
* CVE-2016-9074: existing mitigation of timing side-channel attacks insufficient

Comment 2 Arvid Requate

2017-05-23 11:57:55 CEST

Upstream Debian package version 2:3.26-1+debu7u3 fixes:

* Out-of-bounds write in Base64 encoding. This can trigger a crash (denial of service) and might be exploitable for code execution (CVE-2017-5461)

*  A flaw in DRBG number generation where the internal state V does not correctly carry bits over (CVE-2017-5462)

Comment 3 Arvid Requate

2017-05-23 12:14:47 CEST

Mozilla Network Security Service (nss) is used by openjdk-7-jre-headless and libreoffice-core, e.g.

Comment 4 Arvid Requate

2017-05-23 14:20:51 CEST

Upstream package imported and built in errata4.1-4.

Advisory: nss.yaml

Comment 5 Arvid Requate

2017-06-01 21:24:39 CEST

Upstream Debian package version 2:3.26-1+debu7u4 fixes:

* Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker (CVE-2017-7502)

Package rebuilt with patch, advisory updated.

Comment 6 Janek Walkenhorst

2017-07-04 16:09:44 CEST

Tests (amd64): OK
Advisory: OK

Comment 7 Janek Walkenhorst

2017-07-05 13:32:17 CEST

<http://errata.software-univention.de/ucs/4.1/438.html>