nspr-4.9.5-2.AXS3, nss-3.14.3-18.AXS3

nss Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

nspr NSPR provides platform independence for non-GUI operating system facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval timing and calendar time, basic memory management (malloc and free) and shared library linking.

Security issues fixed with this release:

• CVE-2013-0791
The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted certificate.

• CVE-2013-1620
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

Fixed bugs:

• Previously, a defect in the FreeBL library implementation of the Diffie-Hellman (DH) protocol caused Openswan to drop connections; this has been fixed.

• Fixed a memory leak in the nssutil_ReadSecmodDB() function.

• nss now protects itself against being called before it has been properly initialized by the caller.

• Previously the certutil -H command did not describe the -F option. This has been fixed.

• Previously, a bug in the FreeBL library made the Openswan application generate a Key Exchange payload that was one byte shorter than what was required by the Diffie Hellman (DH) protocol, and Openswan would drop connections. This has been fixed.

• Previously, the remote-viewer utility failed to utilize a plugged-in smart card reader when a Spice client was running and the client could eventually crash. This has been fixed.

• Incorporated various GCM code fixes.

Enhancement:

• Added support for the NIST Suite B set of recommended algorithms for Elliptic Curve Cryptography.

After installation, applications using NSS or NSPR must be restarted for this update to take effect.