Slackware: 2021-337-01: mozilla-nss Security Update

Advisories


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  mozilla-nss (SSA:2021-337-01)

New mozilla-nss packages are available for Slackware 14.0, 14.1, 14.2,
and -current to fix a security issue.


Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/mozilla-nss-3.40.1-i586-2_slack14.2.txz:  Rebuilt.
  This update fixes a critical security issue:
  NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are
  vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS
  signatures. Applications using NSS for handling signatures encoded within
  CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications
  using NSS for certificate validation or other TLS, X.509, OCSP or CRL
  functionality may be impacted, depending on how they configure NSS.
  Note: This vulnerability does NOT impact Mozilla Firefox. However, email
  clients and PDF viewers that use NSS for signature verification, such as
  Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.
  Thanks to Tavis Ormandy of Google Project Zero.
  For more information, see:
    https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43527
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(https://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on https://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-nss-3.23-i486-2_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-nss-3.23-x86_64-2_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-nss-3.40.1-i486-2_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-nss-3.40.1-x86_64-2_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mozilla-nss-3.40.1-i586-2_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mozilla-nss-3.40.1-x86_64-2_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/mozilla-nss-3.73-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/mozilla-nss-3.73-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 14.0 package:
056b2ea567f36c1cd6acc2d8c89932ef  mozilla-nss-3.23-i486-2_slack14.0.txz

Slackware x86_64 14.0 package:
506bc80f1c301e8094cc77240181d04a  mozilla-nss-3.23-x86_64-2_slack14.0.txz

Slackware 14.1 package:
ff4d91d43def0a765fea66bc2e73c580  mozilla-nss-3.40.1-i486-2_slack14.1.txz

Slackware x86_64 14.1 package:
6a6178f191e3458b3221b6a9b34a3363  mozilla-nss-3.40.1-x86_64-2_slack14.1.txz

Slackware 14.2 package:
5e77554ebc0b352ead1ea22a90d93954  mozilla-nss-3.40.1-i586-2_slack14.2.txz

Slackware x86_64 14.2 package:
c57b665cd9eb1c1d48777a748e56881e  mozilla-nss-3.40.1-x86_64-2_slack14.2.txz

Slackware -current package:
fce85e92e5737cabcefc7dad628c6b6f  l/mozilla-nss-3.73-i586-1.txz

Slackware x86_64 -current package:
caa2668e6a9b005f820d13c9e616a80c  l/mozilla-nss-3.73-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg mozilla-nss-3.40.1-i586-2_slack14.2.txz


+-----+

Slackware: 2021-337-01: mozilla-nss Security Update

December 3, 2021
New mozilla-nss packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue

Summary

Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mozilla-nss-3.40.1-i586-2_slack14.2.txz: Rebuilt. This update fixes a critical security issue: NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. Note: This vulnerability does NOT impact Mozilla Firefox. However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted. Thanks to Tavis Ormandy of Google Project Zero. For more information, see: https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43527 (* Security fix *)

Where Find New Packages

Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on https://slackware.com for additional mirror sites near you.
Updated package for Slackware 14.0: ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-nss-3.23-i486-2_slack14.0.txz
Updated package for Slackware x86_64 14.0: ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-nss-3.23-x86_64-2_slack14.0.txz
Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-nss-3.40.1-i486-2_slack14.1.txz
Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-nss-3.40.1-x86_64-2_slack14.1.txz
Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mozilla-nss-3.40.1-i586-2_slack14.2.txz
Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mozilla-nss-3.40.1-x86_64-2_slack14.2.txz
Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/mozilla-nss-3.73-i586-1.txz
Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/mozilla-nss-3.73-x86_64-1.txz

MD5 Signatures

Slackware 14.0 package: 056b2ea567f36c1cd6acc2d8c89932ef mozilla-nss-3.23-i486-2_slack14.0.txz
Slackware x86_64 14.0 package: 506bc80f1c301e8094cc77240181d04a mozilla-nss-3.23-x86_64-2_slack14.0.txz
Slackware 14.1 package: ff4d91d43def0a765fea66bc2e73c580 mozilla-nss-3.40.1-i486-2_slack14.1.txz
Slackware x86_64 14.1 package: 6a6178f191e3458b3221b6a9b34a3363 mozilla-nss-3.40.1-x86_64-2_slack14.1.txz
Slackware 14.2 package: 5e77554ebc0b352ead1ea22a90d93954 mozilla-nss-3.40.1-i586-2_slack14.2.txz
Slackware x86_64 14.2 package: c57b665cd9eb1c1d48777a748e56881e mozilla-nss-3.40.1-x86_64-2_slack14.2.txz
Slackware -current package: fce85e92e5737cabcefc7dad628c6b6f l/mozilla-nss-3.73-i586-1.txz
Slackware x86_64 -current package: caa2668e6a9b005f820d13c9e616a80c l/mozilla-nss-3.73-x86_64-1.txz

Severity
[slackware-security] mozilla-nss (SSA:2021-337-01)
New mozilla-nss packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg mozilla-nss-3.40.1-i586-2_slack14.2.txz

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.