Bug 42858 - nss: Multiple issues (4.1)
nss: Multiple issues (4.1)
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.1
Other Linux
: P2 normal (vote)
: UCS 4.1-4-errata
Assigned To: Arvid Requate
Janek Walkenhorst
Depends on: 41565 44777
Blocks: 41334
  Show dependency treegraph
Reported: 2016-11-05 20:49 CET by Arvid Requate
Modified: 2017-07-05 13:32 CEST (History)
2 users (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
requate: Patch_Available+


Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2016-11-05 20:49:14 CET
Upstream Debian package has bee updated to version 2:3.26-1+debu7u1 which fixes:

The Network Security Service (NSS) libraries uses environment variables to configure lots of things, some of which refer to file system locations. Others can be degrade the operation of NSS in various ways, forcing compatibility modes and so on.

Previously, these environment variables were not ignored SUID binaries. This version of NetScape Portable Runtime Library (NSPR) introduce a new API, PR_GetEnVSecure, to address this.

Both NSPR and NSS need to be upgraded to address this problem.
Comment 1 Janek Walkenhorst univentionstaff 2017-01-17 16:51:31 CET
nss (2:3.26-1+debu7u2) wheezy-security
* CVE-2016-9074: existing mitigation of timing side-channel attacks insufficient
Comment 2 Arvid Requate univentionstaff 2017-05-23 11:57:55 CEST
Upstream Debian package version 2:3.26-1+debu7u3 fixes:

* Out-of-bounds write in Base64 encoding. This can trigger a crash (denial of service) and might be exploitable for code execution (CVE-2017-5461)

*  A flaw in DRBG number generation where the internal state V does not correctly carry bits over (CVE-2017-5462)
Comment 3 Arvid Requate univentionstaff 2017-05-23 12:14:47 CEST
Mozilla Network Security Service (nss) is used by openjdk-7-jre-headless and libreoffice-core, e.g.
Comment 4 Arvid Requate univentionstaff 2017-05-23 14:20:51 CEST
Upstream package imported and built in errata4.1-4.

Advisory: nss.yaml
Comment 5 Arvid Requate univentionstaff 2017-06-01 21:24:39 CEST
Upstream Debian package version 2:3.26-1+debu7u4 fixes:

* Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker (CVE-2017-7502)

Package rebuilt with patch, advisory updated.
Comment 6 Janek Walkenhorst univentionstaff 2017-07-04 16:09:44 CEST
Tests (amd64): OK
Advisory: OK
Comment 7 Janek Walkenhorst univentionstaff 2017-07-05 13:32:17 CEST