A mozilla-nss (SSA:2021-337-01) security update has been released for Slackware 14.0, 14.1, 14.2, and -current.
slackware-security: mozilla-nss (SSA:2021-337-01)
[slackware-security] mozilla-nss (SSA:2021-337-01)
New mozilla-nss packages are available for Slackware 14.0, 14.1, 14.2,
and -current to fix a security issue.
Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/mozilla-nss-3.40.1-i586-2_slack14.2.txz: Rebuilt.
This update fixes a critical security issue:
NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are
vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS
signatures. Applications using NSS for handling signatures encoded within
CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications
using NSS for certificate validation or other TLS, X.509, OCSP or CRL
functionality may be impacted, depending on how they configure NSS.
Note: This vulnerability does NOT impact Mozilla Firefox. However, email
clients and PDF viewers that use NSS for signature verification, such as
Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.
Thanks to Tavis Ormandy of Google Project Zero.
For more information, see:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43527
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
( http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mozilla-nss-3.23-i486-2_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mozilla-nss-3.23-x86_64-2_slack14.0.txz
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mozilla-nss-3.40.1-i486-2_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mozilla-nss-3.40.1-x86_64-2_slack14.1.txz
Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mozilla-nss-3.40.1-i586-2_slack14.2.txz
Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mozilla-nss-3.40.1-x86_64-2_slack14.2.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/mozilla-nss-3.73-i586-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/mozilla-nss-3.73-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 14.0 package:
056b2ea567f36c1cd6acc2d8c89932ef mozilla-nss-3.23-i486-2_slack14.0.txz
Slackware x86_64 14.0 package:
506bc80f1c301e8094cc77240181d04a mozilla-nss-3.23-x86_64-2_slack14.0.txz
Slackware 14.1 package:
ff4d91d43def0a765fea66bc2e73c580 mozilla-nss-3.40.1-i486-2_slack14.1.txz
Slackware x86_64 14.1 package:
6a6178f191e3458b3221b6a9b34a3363 mozilla-nss-3.40.1-x86_64-2_slack14.1.txz
Slackware 14.2 package:
5e77554ebc0b352ead1ea22a90d93954 mozilla-nss-3.40.1-i586-2_slack14.2.txz
Slackware x86_64 14.2 package:
c57b665cd9eb1c1d48777a748e56881e mozilla-nss-3.40.1-x86_64-2_slack14.2.txz
Slackware -current package:
fce85e92e5737cabcefc7dad628c6b6f l/mozilla-nss-3.73-i586-1.txz
Slackware x86_64 -current package:
caa2668e6a9b005f820d13c9e616a80c l/mozilla-nss-3.73-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the package as root:
# upgradepkg mozilla-nss-3.40.1-i586-2_slack14.2.txz
