Medium ELSA-2016-2779 3 CVEs

Moderate: nss and nss-util security update (Oracle Linux 7)

Published Nov 16, 2016 · Updated Nov 16, 2016

Ecosystem: Oracle Linux

Summary

nss
[3.21.3-2.0.1]
- Added nss-vendor.patch to change vendor

[3.21.3-2]
- Mozilla #1314604 / Red Hat CVE-2016-8635

[3.21.3-1.1]
- rebuild

[3.21.3-1]
- Rebase to NSS 3.21.3
- Resolves: #1383887

nss-util
[3.21.3-1.1]
- rebuild

[3.21.3-1]
- Rebase to nss-3.21.3
- Remove patch for CVE-2016-1950, which is included in the release
- Related: Bug 1347908

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 7	nss	0:3.21.3-2.0.1.el7_3
Oracle Linux · 7	nss-devel	0:3.21.3-2.0.1.el7_3
Oracle Linux · 7	nss-pkcs11-devel	0:3.21.3-2.0.1.el7_3
Oracle Linux · 7	nss-sysinit	0:3.21.3-2.0.1.el7_3
Oracle Linux · 7	nss-tools	0:3.21.3-2.0.1.el7_3
Oracle Linux · 7	nss-util	0:3.21.3-1.1.el7_3
Oracle Linux · 7	nss-util-devel	0:3.21.3-1.1.el7_3

Vulnerabilities 3

Medium 5.3

CVE-2016-8635

It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinemen…

Mozilla NSS nss nss Debian Ubuntu

Aug 1, 2018
Unscored —

CVE-2016-2834

Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to…

thunderbird firefox nss nss Debian Ubuntu

Jun 13, 2016
Unscored —

CVE-2016-5285

A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK1…

Mozilla Network Security Services nss nss Debian Ubuntu

Nov 15, 2019