nss update
This update removes the "emSign ECC Root CA - G3" and "Comodo AAA Services root" CA certificate due to intermediate CA certificates being compromised.
- Mettez à jour vers 2:3.98-0ubuntu0.22.04.5
Publication Mise à jour
PatchFirst · Vulnérabilités récentes
Vulnérabilités de nss
Vulnérabilité publiée pour nss au cours des 30 derniers jours : 1. Dans le catalogue KEV : 0.
Vulnérabilités : 9
Incorrect boundary conditions in the Libraries component in NSS
Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
- Mettez à jour vers 2:3.98-0ubuntu0.22.04.4
Publication Mise à jourInteger overflow in the Libraries component in NSS
Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.
- Mettez à jour vers 2:3.98-0ubuntu0.22.04.3
Publication Mise à journss regression
USN-6727-1 fixed vulnerabilities in NSS. The update introduced a regression when trying to load security modules on Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that NSS incorrectly handled padding when checking PKCS#1 certificates. A remote attacker could possibly use this issue to perform Bleichenbacher-like attacks and recover private data. This issue only affected Ubuntu 20.04 LTS. (CVE-2023-4421) It was discovered that NSS had a timing side-channel when performing RSA decryption. A remote attacker could possibly use this i
- Mettez à jour vers 2:3.98-0ubuntu0.22.04.2
Publication Mise à jourCVE-2023-5388
NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the private data. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.
- Mettez à jour vers 2:3.98-0ubuntu0.22.04.1
Publication Mise à jourCVE-2023-6135
Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the private key. This vulnerability affects Firefox < 121.
- Mettez à jour vers 2:3.98-0ubuntu0.22.04.1
Publication Mise à jourCVE-2023-0767
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. This vulnerability affects Firefox < 110, Thunderbird < 102.8, and Firefox ESR < 102.8.
- Mettez à jour vers 2:3.68.2-0ubuntu1.2
Publication Mise à jourCVE-2022-34480
Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite never being allocated. This vulnerability affects Firefox < 102.
- Mettez à jour vers 2:3.68.2-0ubuntu1.1
Publication Mise à jourCVE-2021-43527
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \#7, or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impa
- Mettez à jour vers 2:3.68-1ubuntu2
Publication Mise à jour
Vérifiez votre serveur
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.