安全公告详情

NS-SA-2022-0005

2022-05-08 17:47:44

简介

important: nss/firefox security update

严重级别

important

主题

An update for nss/firefox is now available for NewStart CGSL MAIN 5.04/CGSL CORE 5.04.
NewStart Security has rated this update as having a security impact of important. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

nss: Library files for developing PKCS #11 modules using basic NSS low level services.
firefox: This package provides debug information for package firefox. Debug information is useful when developing applications that use this package or when debugging this package.


Security Fix(es):
nss: A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability.(CVE-2020-25648)
nss: bugfix
firefox: A malicious webpage could have triggered a use-after-free, memory corruption, and a potentially exploitable crash. *This bug could only be triggered when accessibility was enabled.*. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.(CVE-2021-29970)
firefox: Mozilla developers reported memory safety bugs present in code shared between Firefox and Thunderbird. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 78.12, Firefox ESR < 78.12, and Firefox < 90.(CVE-2021-29976)
firefox: Out of bounds write in ANGLE in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.(CVE-2021-30547)
firefox: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 5.04.F35B4.

影响组件

  • nss
  • firefox

影响产品

  • CGSL MAIN 5.04
  • CGSL CORE 5.04

更新包

{"fix":[{"product":"CGSL MAIN 5.04","pkgs":[{"binary":["nss-sysinit-3.53.1-7.el7_9.cgslv5.0.1.g7229b06.x86_64.rpm","nss-tools-3.53.1-7.el7_9.cgslv5.0.1.g7229b06.x86_64.rpm","nss-debuginfo-3.53.1-7.el7_9.cgslv5.0.1.g7229b06.x86_64.rpm","nss-3.53.1-7.el7_9.cgslv5.0.1.g7229b06.x86_64.rpm","nss-devel-3.53.1-7.el7_9.cgslv5.0.1.g7229b06.x86_64.rpm","nss-pkcs11-devel-3.53.1-7.el7_9.cgslv5.0.1.g7229b06.x86_64.rpm"],"source":"nss-3.53.1-7.el7_9.cgslv5.0.1.g7229b06.src.rpm"},{"binary":["firefox-78.12.0-1.el7.centos.x86_64.rpm","firefox-debuginfo-78.12.0-1.el7.centos.x86_64.rpm"],"source":"firefox-78.12.0-1.el7.centos.src.rpm"}]},{"product":"CGSL CORE 5.04","pkgs":[{"binary":["nss-3.53.1-7.el7_9.cgslv5.0.3.ga74dcc2.lite.x86_64.rpm","nss-debuginfo-3.53.1-7.el7_9.cgslv5.0.3.ga74dcc2.lite.x86_64.rpm","nss-devel-3.53.1-7.el7_9.cgslv5.0.3.ga74dcc2.lite.x86_64.rpm","nss-tools-3.53.1-7.el7_9.cgslv5.0.3.ga74dcc2.lite.x86_64.rpm","nss-sysinit-3.53.1-7.el7_9.cgslv5.0.3.ga74dcc2.lite.x86_64.rpm","nss-pkcs11-devel-3.53.1-7.el7_9.cgslv5.0.3.ga74dcc2.lite.x86_64.rpm"],"source":"nss-3.53.1-7.el7_9.cgslv5.0.3.ga74dcc2.lite.src.rpm"},{"binary":["firefox-78.12.0-1.el7.centos.x86_64.rpm","firefox-debuginfo-78.12.0-1.el7.centos.x86_64.rpm"],"source":"firefox-78.12.0-1.el7.centos.src.rpm"}]}]}

CVE

参考