SUSE: 2020:14418-1 important: mozilla-nspr, mozilla-nss
Summary
This update for mozilla-nspr, mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032). - CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978). - CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819). - CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669). - Fixed an issue where Firefox tab was crashing (bsc#1170908). Release notes: ase_notes mozilla-nspr was updated to version 4.25. Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-LTSS: zypper in -t patch slessp4-mozilla-nss-nspr-202007-14418=1 Package List: - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 ppc64 s390x x86_64): mozilla-nspr-4.25-29.12.2 mozilla-nspr-devel-4.25-29.12.2 - SUSE Linux Enterprise Server 11-SP4-LTSS (ppc64 s390x x86_64): mozilla-nspr-32bit-4.25-29.12.2 - SUSE Linux Enterprise Server 11-SP4-LTSS (i586 x86_64): libfreebl3-3.53.1-38.23.1 libsoftokn3-3.53.1-38.23.1 mozilla-nss-3.53.1-38.23.1 mozilla-nss-certs-3.53.1-38.23.1 mozilla-nss-devel-3.53.1-38.23.1 mozilla-nss-tools-3.53.1-38.23.1 - SUSE Linux Enterprise Server 11-SP4-LTSS (x86_64): libfreebl3-32bit-3.53.1-38.23.1 libsoftokn3-32bit-3.53.1-38.23.1 mozilla-nss-32bit-3.53.1-38.23.1 mozilla-nss-certs-32bit-3.53.1-38.23.1
References
#1141322 #1158527 #1159819 #1168669 #1169746
#1170908 #1171978 #1173032
Cross- CVE-2019-11727 CVE-2019-11745 CVE-2019-17006
CVE-2020-12399 CVE-2020-12402
Affected Products:
SUSE Linux Enterprise Server 11-SP4-LTSS
https://www.suse.com/security/cve/CVE-2019-11727.html
https://www.suse.com/security/cve/CVE-2019-11745.html
https://www.suse.com/security/cve/CVE-2019-17006.html
https://www.suse.com/security/cve/CVE-2020-12399.html
https://www.suse.com/security/cve/CVE-2020-12402.html
https://bugzilla.suse.com/1141322
https://bugzilla.suse.com/1158527
https://bugzilla.suse.com/1159819
https://bugzilla.suse.com/1168669
https://bugzilla.suse.com/1169746
https://bugzilla.suse.com/1170908
https://bugzilla.suse.com/1171978
https://bugzilla.suse.com/1173032