Synopsis:          Moderate: nss and nspr security, bug fix, and 

Advisory ID:       SLSA-2016:0684-1

Issue Date:        2016-04-25

CVE Numbers:       CVE-2016-1979

                   CVE-2016-1978

--



The following packages have been upgraded to a newer upstream version: nss

3.21.0, nspr 4.11.0.



Security Fix(es):



* A use-after-free flaw was found in the way NSS handled DHE (Diffie-

Hellman key exchange) and ECDHE (Elliptic Curve Diffie-Hellman key

exchange) handshake messages. A remote attacker could send a specially

crafted handshake message that, when parsed by an application linked

against NSS, would cause that application to crash or, under certain

special conditions, execute arbitrary code using the permissions of the

user running the application. (CVE-2016-1978)



* A use-after-free flaw was found in the way NSS processed certain DER

(Distinguished Encoding Rules) encoded cryptographic keys. An attacker

could use this flaw to create a specially crafted DER encoded certificate

which, when parsed by an application compiled against the NSS library,

could cause that application to crash, or execute arbitrary code using the

permissions of the user running the application. (CVE-2016-1979)

--



SL5

  x86_64

    nspr-4.11.0-1.el5_11.i386.rpm

    nspr-4.11.0-1.el5_11.x86_64.rpm

    nspr-debuginfo-4.11.0-1.el5_11.i386.rpm

    nspr-debuginfo-4.11.0-1.el5_11.x86_64.rpm

    nss-3.21.0-6.el5_11.i386.rpm

    nss-3.21.0-6.el5_11.x86_64.rpm

    nss-debuginfo-3.21.0-6.el5_11.i386.rpm

    nss-debuginfo-3.21.0-6.el5_11.x86_64.rpm

    nss-tools-3.21.0-6.el5_11.x86_64.rpm

    nspr-devel-4.11.0-1.el5_11.i386.rpm

    nspr-devel-4.11.0-1.el5_11.x86_64.rpm

    nss-devel-3.21.0-6.el5_11.i386.rpm

    nss-devel-3.21.0-6.el5_11.x86_64.rpm

    nss-pkcs11-devel-3.21.0-6.el5_11.i386.rpm

    nss-pkcs11-devel-3.21.0-6.el5_11.x86_64.rpm

  i386

    nspr-4.11.0-1.el5_11.i386.rpm

    nspr-debuginfo-4.11.0-1.el5_11.i386.rpm

    nss-3.21.0-6.el5_11.i386.rpm

    nss-debuginfo-3.21.0-6.el5_11.i386.rpm

    nss-tools-3.21.0-6.el5_11.i386.rpm

    nspr-devel-4.11.0-1.el5_11.i386.rpm

    nss-devel-3.21.0-6.el5_11.i386.rpm

    nss-pkcs11-devel-3.21.0-6.el5_11.i386.rpm



- Scientific Linux Development Team