UbuntuUpdates.org

Package "nss"

Name: nss

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Network Security Service libraries
  • Debugging symbols for the Network Security Service libraries
  • Development files for the Network Security Service libraries

Latest version: 2:3.35-2ubuntu2.7
Release: bionic (18.04)
Level: security
Repository: main

Links

Save this URL for the latest version of "nss": https://www.ubuntuupdates.org/nss



Other versions of "nss" in Bionic

Repository Area Version
base main 2:3.35-2ubuntu2
base universe 2:3.35-2ubuntu2
security universe 2:3.35-2ubuntu2.7
updates main 2:3.35-2ubuntu2.7
updates universe 2:3.35-2ubuntu2.7

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2:3.35-2ubuntu2.7 2020-01-08 19:07:07 UTC

  nss (2:3.35-2ubuntu2.7) bionic-security; urgency=medium

  * SECURITY UPDATE: Possible wrong length for cryptographic primitives input
    - debian/patches/CVE-2019-17006.patch: adds checks for length of crypto
      primitives in nss/lib/freebl/chacha20poly1305.c,
      nss/lib/freebl/ctr.c, nss/lib/freebl/gcm.c,
      nss/lib/freebl/intel-gcm-wrap.c,
      nss/lib/freebl/rsapkcs.c.
    - CVE-2019-17006

 -- <email address hidden> (Leonidas S. Barbosa) Tue, 07 Jan 2020 14:55:38 -0300

Source diff to previous version
CVE-2019-17006 Check length of inputs for cryptographic primitives

Version: 2:3.35-2ubuntu2.6 2019-12-09 14:07:47 UTC

  nss (2:3.35-2ubuntu2.6) bionic-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-17007.patch: check got some certs in
      collect_certs r=jcj in nss/lib/pkcs7/certread.c,
      gtests/certdb_gtest/certdb_gtest.gyp,
      gtests/certdb_gtest/decode_certs_unittest.cc,
      gtests/certdb_gtest/manifest.mn.
    - CVE-2019-17007

 -- <email address hidden> (Leonidas S. Barbosa) Thu, 05 Dec 2019 13:37:32 -0300

Source diff to previous version
CVE-2019-17007 nss: Handling of Netscape Certificate Sequences in CERT_DecodeCertPackage() may crash with a NULL deref leading to DoS

Version: 2:3.35-2ubuntu2.5 2019-11-27 16:06:29 UTC

  nss (2:3.35-2ubuntu2.5) bionic-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write in NSC_EncryptUpdate
    - debian/patches/CVE-2019-11745.patch: use maxout not block size in
      nss/lib/softoken/pkcs11c.c.
    - CVE-2019-11745
  * Note: this does _not_ contain the changes from 2:3.35-2ubuntu2.4 in
    disco-proposed.

 -- Marc Deslauriers <email address hidden> Tue, 26 Nov 2019 08:53:05 -0500

Source diff to previous version
CVE-2019-11745 Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate

Version: 2:3.35-2ubuntu2.3 2019-07-16 13:07:22 UTC

  nss (2:3.35-2ubuntu2.3) bionic-security; urgency=medium

  * SECURITY UPDATE: OOB read when importing a curve25519 private key
    - debian/patches/CVE-2019-11719.patch: don't unnecessarily strip
      leading 0's from key material during PKCS11 import in
      nss/lib/freebl/ecl/ecp_25519.c, nss/lib/pk11wrap/pk11akey.c,
      nss/lib/pk11wrap/pk11cert.c, nss/lib/pk11wrap/pk11pk12.c,
      nss/lib/softoken/legacydb/lgattr.c, nss/lib/softoken/pkcs11c.c.
    - CVE-2019-11719
  * SECURITY UPDATE: segfault via empty or malformed p256-ECDH public keys
    - debian/patches/CVE-2019-11729-1.patch: more thorough input checking
      in nss/lib/cryptohi/seckey.c, nss/lib/freebl/dh.c,
      nss/lib/freebl/ec.c, nss/lib/util/quickder.c.
    - debian/patches/CVE-2019-11729-2.patch: ignore spki decode failures on
      negative tests in nss/gtests/pk11_gtest/pk11_curve25519_unittest.cc.
    - CVE-2019-11729

 -- Marc Deslauriers <email address hidden> Fri, 12 Jul 2019 08:16:27 -0400

Source diff to previous version

Version: 2:3.35-2ubuntu2.2 2019-02-27 18:06:30 UTC

  nss (2:3.35-2ubuntu2.2) bionic-security; urgency=medium

  * SECURITY UPDATE: DoS in NULL pointer dereference in CMS functions
    - debian/patches/CVE-2018-18508-1.patch: add null checks in
      nss/lib/smime/cmscinfo.c, nss/lib/smime/cmsdigdata.c,
      nss/lib/smime/cmsencdata.c, nss/lib/smime/cmsenvdata.c,
      nss/lib/smime/cmsmessage.c, nss/lib/smime/cmsudf.c.
    - debian/patches/CVE-2018-18508-2.patch: add null checks in
      nss/lib/smime/cmsmessage.c.
    - CVE-2018-18508

 -- Marc Deslauriers <email address hidden> Tue, 19 Feb 2019 13:38:25 +0100

CVE-2018-18508 NULL pointer dereference in several CMS functions resulting in a denial of service



About   -   Send Feedback to @ubuntu_updates