From: Slackware Security Team <security@slackware.com>
To: slackware-security@slackware.com
Subject: [slackware-security] mozilla-nss (SSA:2021-337-01)
Date: Fri, 3 Dec 2021 12:11:32 -0800 (PST)





-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] mozilla-nss (SSA:2021-337-01)

New mozilla-nss packages are available for Slackware 14.0, 14.1, 14.2,
and -current to fix a security issue.


Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/mozilla-nss-3.40.1-i586-2_slack14.2.txz: Rebuilt.
This update fixes a critical security issue:
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are
vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS
signatures. Applications using NSS for handling signatures encoded within
CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications
using NSS for certificate validation or other TLS, X.509, OCSP or CRL
functionality may be impacted, depending on how they configure NSS.
Note: This vulnerability does NOT impact Mozilla Firefox. However, email
clients and PDF viewers that use NSS for signature verification, such as
Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.
Thanks to Tavis Ormandy of Google Project Zero.
For more information, see:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43527
(* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-nss-3.23-i486-2_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-nss-3.23-x86_64-2_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-nss-3.40.1-i486-2_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-nss-3.40.1-x86_64-2_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mozilla-nss-3.40.1-i586-2_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mozilla-nss-3.40.1-x86_64-2_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/mozilla-nss-3.73-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/mozilla-nss-3.73-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 14.0 package:
056b2ea567f36c1cd6acc2d8c89932ef mozilla-nss-3.23-i486-2_slack14.0.txz

Slackware x86_64 14.0 package:
506bc80f1c301e8094cc77240181d04a mozilla-nss-3.23-x86_64-2_slack14.0.txz

Slackware 14.1 package:
ff4d91d43def0a765fea66bc2e73c580 mozilla-nss-3.40.1-i486-2_slack14.1.txz

Slackware x86_64 14.1 package:
6a6178f191e3458b3221b6a9b34a3363 mozilla-nss-3.40.1-x86_64-2_slack14.1.txz

Slackware 14.2 package:
5e77554ebc0b352ead1ea22a90d93954 mozilla-nss-3.40.1-i586-2_slack14.2.txz

Slackware x86_64 14.2 package:
c57b665cd9eb1c1d48777a748e56881e mozilla-nss-3.40.1-x86_64-2_slack14.2.txz

Slackware -current package:
fce85e92e5737cabcefc7dad628c6b6f l/mozilla-nss-3.73-i586-1.txz

Slackware x86_64 -current package:
caa2668e6a9b005f820d13c9e616a80c l/mozilla-nss-3.73-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg mozilla-nss-3.40.1-i586-2_slack14.2.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAmGqeVIACgkQakRjwEAQIjPAfQCdGDeyxMt9/UH9HgVxAcoRJ2Gw
fwgAoJIe5mp4TbA1nnq1AdZ6erTTkkn+
=Wc2U
-----END PGP SIGNATURE-----