UbuntuUpdates.org

Package "libnss3"

Name: libnss3

Description:

Network Security Service libraries

Latest version: 2:3.49.1-1ubuntu1.9
Release: focal (20.04)
Level: security
Repository: main
Head package: nss
Homepage: http://www.mozilla.org/projects/security/pki/nss/

Links


Download "libnss3"


Other versions of "libnss3" in Focal

Repository Area Version
base main 2:3.49.1-1ubuntu1
updates main 2:3.49.1-1ubuntu1.9

Changelog

Version: 2:3.49.1-1ubuntu1.9 2023-02-27 14:07:01 UTC

  nss (2:3.49.1-1ubuntu1.9) focal-security; urgency=medium

  * SECURITY UPDATE: Arbitrary memory write via PKCS 12 in NSS
    - debian/patches/CVE-2023-0767.patch: improve handling of unknown
      PKCS#12 safe bag types in nss/lib/pkcs12/p12d.c,
      nss/lib/pkcs12/p12t.h, nss/lib/pkcs12/p12tmpl.c.
    - CVE-2023-0767

 -- Marc Deslauriers <email address hidden> Fri, 17 Feb 2023 09:50:54 -0500

Source diff to previous version

Version: 2:3.49.1-1ubuntu1.8 2022-07-07 14:06:36 UTC

  nss (2:3.49.1-1ubuntu1.8) focal-security; urgency=medium

  * SECURITY UPDATE: Crash when handling empty pkcs7 sequence
    - debian/patches/CVE-2022-22747.patch: check for missing signedData
      field in nss/gtests/certdb_gtest/decode_certs_unittest.cc,
      nss/lib/pkcs7/certread.c.
    - CVE-2022-22747
  * SECURITY UPDATE: Free of uninitialized pointer in lg_init
    - debian/patches/CVE-2022-34480.patch: rearrange frees in
      nss/lib/softoken/legacydb/lginit.c.
    - CVE-2022-34480

 -- Marc Deslauriers <email address hidden> Wed, 06 Jul 2022 07:23:47 -0400

Source diff to previous version

Version: 2:3.49.1-1ubuntu1.7 2022-05-11 10:06:26 UTC

  nss (2:3.49.1-1ubuntu1.7) focal-security; urgency=medium

  * SECURITY UPDATE: Denial of service through ChangeCipherSpec
    - debian/patches/CVE-2020-25648-1.patch: reject CCS when
      compatibility is not specify or if many CCS in a row in
      nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc,
      nss/lib/ssl/ssl3con.c and nss/lib/ssl/sslimpl.h.
    - debian/patches/CVE-2020-25648-2.patch: reject multiple CCS
      packages but allow the first one in
      nss/gtests/ssl_gtest/ssl_tls13compat_unittest.cc,
      nss/lib/ssl/ssl3con.c and nss/lib/ssl/sslimpl.h.
    - CVE-2020-25648

 -- David Fernandez Gonzalez <email address hidden> Mon, 09 May 2022 15:35:11 +0200

Source diff to previous version
CVE-2020-25648 A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages,

Version: 2:3.49.1-1ubuntu1.6 2021-12-01 18:07:05 UTC

  nss (2:3.49.1-1ubuntu1.6) focal-security; urgency=medium

  * SECURITY UPDATE: heap overflow when verifying DSA/RSA-PSS DER-encoded
    signatures
    - debian/patches/CVE-2021-43527.patch: check signature lengths in
      nss/lib/cryptohi/secvfy.c.
    - CVE-2021-43527

 -- Marc Deslauriers <email address hidden> Mon, 29 Nov 2021 07:15:58 -0500

Source diff to previous version
CVE-2021-43527 Heap overflow in NSS when verifying DSA/RSA-PSS DER-encoded signatures

Version: 2:3.49.1-1ubuntu1.5 2020-08-27 17:07:07 UTC

  nss (2:3.49.1-1ubuntu1.5) focal-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds read
    - debian/patches/CVE-2020-12403-*.patch: disable PKCS11 incremental
      mode for ChaCha20 and fix incorrect call to ChaChaPoly1305 by PKCS11
      in nss/gtests/pk11_gtest/pk11_cipherop_unittest.cc,
      nss/gtests/pk11_gtest/pk11_chacha20poly1305_unittest.cc,
      nss/lib/softoken/pkcs11c.c, nss/lib/freebl/chacha20poly1305.c.
    - CVE-2020-12403

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 20 Aug 2020 12:02:04 -0300




About   -   Send Feedback to @ubuntu_updates