TI-2019-12689 CVE-2019-17006 · GHSA-h4cr-x49j-2r7w
Memory corruption in Mozilla NSS
Priority MEDIUM 48
In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks.
RHSA-2021:0876
nss and nss-softokn security update
Released 2021-03-16 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) nss-3.36.0-9.el7_6, nss-softokn-3.36.0-7.el7_6, nss-softokn-freebl-3.36.0-7.el7_6 +2
- Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) nss-devel-3.36.0-9.el7_6, nss-pkcs11-devel-3.36.0-9.el7_6, nss-softokn-devel-3.36.0-7.el7_6 +1
- Red Hat Enterprise Linux Server EUS (v. 7.6) nss-3.36.0-9.el7_6, nss-3.36.0-9.el7_6.ppc, nss-devel-3.36.0-9.el7_6 +11
- Red Hat Enterprise Linux Server Optional EUS (v. 7.6) nss-pkcs11-devel-3.36.0-9.el7_6, nss-pkcs11-devel-3.36.0-9.el7_6.ppc
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) nss-3.36.0-9.el7_6, nss-devel-3.36.0-9.el7_6, nss-softokn-3.36.0-7.el7_6 +5
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) nss-pkcs11-devel-3.36.0-9.el7_6
Fixes 4 records
TI-2020-09921 CVE-2020-12403 · GHSA-9h25-47mw-52hh
Out-of-bounds read in nss
Priority MEDIUM 42
A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55.
TI-2019-08813 CVE-2019-11756 · GHSA-v78f-65qq-96m8
Use after free in Mozilla Firefox
Priority MEDIUM 41
Improper refcounting of soft token session objects could cause a use-after-free and crash (likely limited to a denial of service).
TI-2019-12690 CVE-2019-17007 · GHSA-fcjm-r5rj-fq7w
Improper certificate validation in Mozilla NSS
Priority LOW 36
In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service.