Stay Secure with the Latest Linux Advisories

security advisorysecurity updatedebian

Debian 11: DLA-3937-1 critical: nss memory issues and TLS handshake exploit

nss - Network Security Service libraries This is a set of libraries designed to support cross-platform development of security-enabled client and server applications. It can support SSLv2 . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3937-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Arturo Borrero Gonzalez October 27, 2024 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package : nss Version : 2:3.61-1+deb11u4 CVE ID : CVE-2024-0743 CVE-2024-6602 CVE-2024-6609 nss - Network Security Service libraries This is a set of libraries designed to support cross-platform development of security-enabled client and server applications. It can support SSLv2 and v4, TLS, PKCS #5, #7, #11, #12, S/MIME, X.509 v3 certificates and other security standards. Among other utilities, this package includes: * certutil: manages certificate and key databases (cert7.db and key3.db) * modutil: manages the database of PKCS11 modules (secmod.db) * pk12util: imports/exports keys and certificates between the cert/key databases and files in PKCS12 format. * shlibsign: creates .chk files for use in FIPS mode. * signtool: creates digitally-signed jar archives containing files and/or code. * ssltap: proxy requests for an SSL server and display the contents of the messages exchanged between the client and server. CVE-2024-0743 An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. CVE-2024-6602 A mismatch between allocator and deallocator could have lead to memory corruption. CVE-2024-6609 When almost out-of-memory an elliptic curve key which was never allocated could have been freed again. For Debian 11 bullseye, these problems have been fixed in version 2:3.61-1+deb11u4. We recommend that you upgrade your nss packages. For thedetailed security status of nss please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/nss Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Debian LTS has rolled out an update for nss libraries that fixes critical security vulnerabilities, including memory corruption and TLS issues, enhancing security and stability. nss libraries, Debian LTS, network security, software update. . Severity: Critical. LinuxSecurity.com Team

Oct 28, 2024 •Critical Debian LTS