Red Hat Security Advisory: nss and nss-softokn security update

Fixed packages 22

Vulnerabilities 4

• Unscored —
  CVE-2019-11756

  Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial o…

  Mozilla Firefox mozjs38 mozjs52 Browsers Ubuntu
  Jan 8, 2020
• Unscored —
  CVE-2019-17006

  In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases wh…

  Mozilla NSS nss nss Debian Ubuntu
  Oct 22, 2020
• Unscored —
  CVE-2019-17007

  In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting i…

  Mozilla NSS nss nss Debian Ubuntu
  Oct 22, 2020
• Unscored —
  CVE-2020-12403

  A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Cha…

  nss nss nss nss Debian Ubuntu Azure Linux Alpine
  May 27, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1703979
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1774835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1775916
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1868931
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0876.json
• report
  https://access.redhat.com/security/cve/CVE-2019-11756
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11756
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11756
• article
  https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes
• report
  https://access.redhat.com/security/cve/CVE-2019-17006
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17006
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17006
• article
  https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
• report
  https://access.redhat.com/security/cve/CVE-2019-17007
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17007
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17007
• report
  https://access.redhat.com/security/cve/CVE-2020-12403
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12403
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12403
• article
  https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.55_release_notes