Security update for mozilla-nspr, mozilla-nss SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:14418-1 Final 1 1 2020-07-06T14:31:09Z current 2020-07-06T14:31:09Z 2020-07-06T14:31:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mozilla-nspr, mozilla-nss This update for mozilla-nspr, mozilla-nss fixes the following issues: mozilla-nss was updated to version 3.53.1 - CVE-2019-11745: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate - CVE-2020-12402: Fixed a potential side channel attack during RSA key generation (bsc#1173032). - CVE-2020-12399: Fixed a timing attack on DSA signature generation (bsc#1171978). - CVE-2019-17006: Added length checks for cryptographic primitives (bsc#1159819). - CVE-2019-11727: A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. - Fixed various FIPS issues in libfreebl3 which were causing segfaults in the test suite of chrony (bsc#1168669). - Fixed an issue where Firefox tab was crashing (bsc#1170908). Release notes: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.53_release_notes mozilla-nspr was updated to version 4.25. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). slessp4-mozilla-nss-nspr-202007-14418 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-202014418-1/ Link for SUSE-SU-2020:14418-1 https://lists.suse.com/pipermail/sle-security-updates/2020-July/007079.html E-Mail link for SUSE-SU-2020:14418-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1141322 SUSE Bug 1141322 https://bugzilla.suse.com/1158527 SUSE Bug 1158527 https://bugzilla.suse.com/1159819 SUSE Bug 1159819 https://bugzilla.suse.com/1168669 SUSE Bug 1168669 https://bugzilla.suse.com/1169746 SUSE Bug 1169746 https://bugzilla.suse.com/1170908 SUSE Bug 1170908 https://bugzilla.suse.com/1171978 SUSE Bug 1171978 https://bugzilla.suse.com/1173032 SUSE Bug 1173032 https://www.suse.com/security/cve/CVE-2019-11727/ SUSE CVE CVE-2019-11727 page https://www.suse.com/security/cve/CVE-2019-11745/ SUSE CVE CVE-2019-11745 page https://www.suse.com/security/cve/CVE-2019-17006/ SUSE CVE CVE-2019-17006 page https://www.suse.com/security/cve/CVE-2020-12399/ SUSE CVE CVE-2020-12399 page https://www.suse.com/security/cve/CVE-2020-12402/ SUSE CVE CVE-2020-12402 page SUSE Linux Enterprise Server 11 SP4-LTSS libfreebl3-3.53.1-38.23.1 libfreebl3-32bit-3.53.1-38.23.1 libsoftokn3-3.53.1-38.23.1 libsoftokn3-32bit-3.53.1-38.23.1 mozilla-nspr-4.25-29.12.2 mozilla-nspr-32bit-4.25-29.12.2 mozilla-nspr-devel-4.25-29.12.2 mozilla-nss-3.53.1-38.23.1 mozilla-nss-32bit-3.53.1-38.23.1 mozilla-nss-certs-3.53.1-38.23.1 mozilla-nss-certs-32bit-3.53.1-38.23.1 mozilla-nss-devel-3.53.1-38.23.1 mozilla-nss-tools-3.53.1-38.23.1 libfreebl3-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libfreebl3-32bit-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libsoftokn3-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS libsoftokn3-32bit-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS mozilla-nspr-4.25-29.12.2 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS mozilla-nspr-32bit-4.25-29.12.2 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS mozilla-nspr-devel-4.25-29.12.2 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS mozilla-nss-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS mozilla-nss-32bit-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS mozilla-nss-certs-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS mozilla-nss-certs-32bit-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS mozilla-nss-devel-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS mozilla-nss-tools-3.53.1-38.23.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS A vulnerability exists where it possible to force Network Security Services (NSS) to sign CertificateVerify with PKCS#1 v1.5 signatures when those are the only ones advertised by server in CertificateRequest in TLS 1.3. PKCS#1 v1.5 signatures should not be used for TLS 1.3 messages. This vulnerability affects Firefox < 68. CVE-2019-11727 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-32bit-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-devel-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-devel-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-tools-3.53.1-38.23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014418-1/ https://www.suse.com/security/cve/CVE-2019-11727.html CVE-2019-11727 https://bugzilla.suse.com/1140868 SUSE Bug 1140868 https://bugzilla.suse.com/1141322 SUSE Bug 1141322 When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71. CVE-2019-11745 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-32bit-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-devel-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-devel-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-tools-3.53.1-38.23.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014418-1/ https://www.suse.com/security/cve/CVE-2019-11745.html CVE-2019-11745 https://bugzilla.suse.com/1158328 SUSE Bug 1158328 https://bugzilla.suse.com/1158527 SUSE Bug 1158527 In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow. CVE-2019-17006 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-32bit-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-devel-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-devel-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-tools-3.53.1-38.23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014418-1/ https://www.suse.com/security/cve/CVE-2019-17006.html CVE-2019-17006 https://bugzilla.suse.com/1159819 SUSE Bug 1159819 NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. CVE-2020-12399 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-32bit-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-devel-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-devel-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-tools-3.53.1-38.23.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014418-1/ https://www.suse.com/security/cve/CVE-2020-12399.html CVE-2020-12399 https://bugzilla.suse.com/1171978 SUSE Bug 1171978 https://bugzilla.suse.com/1172402 SUSE Bug 1172402 During RSA key generation, bignum implementations used a variation of the Binary Extended Euclidean Algorithm which entailed significantly input-dependent flow. This allowed an attacker able to perform electromagnetic-based side channel attacks to record traces leading to the recovery of the secret primes. *Note:* An unmodified Firefox browser does not generate RSA keys in normal operation and is not affected, but products built on top of it might. This vulnerability affects Firefox < 78. CVE-2020-12402 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libfreebl3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:libsoftokn3-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-32bit-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nspr-devel-4.25-29.12.2 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-certs-32bit-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-devel-3.53.1-38.23.1 SUSE Linux Enterprise Server 11 SP4-LTSS:mozilla-nss-tools-3.53.1-38.23.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-202014418-1/ https://www.suse.com/security/cve/CVE-2020-12402.html CVE-2020-12402 https://bugzilla.suse.com/1173032 SUSE Bug 1173032 https://bugzilla.suse.com/1173576 SUSE Bug 1173576 https://bugzilla.suse.com/1174230 SUSE Bug 1174230