Issued:

2013-02-20

Updated:

2013-02-20

RHBA-2013:0445 - nss, nss-util, nspr bug fix and enhancement update

Synopsis

nss, nss-util, nspr bug fix and enhancement update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated nss, nss-util, and nspr packages that fix multiple bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.

Description

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications. Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system facilities.

The nss and nss-util packages have been upgraded to upstream version 3.14 which provides a number of bug fixes and enhancements over the previous version. In particular, support for TLS version 1.1 in NSS (RFC 4346). In addition, the nspr packages have been upgraded to upstream version 4.9.2. Note that support for certificate signatures using the MD5 hash algorithm is now disabled by default. For more information, refer to the Mozilla NSS 3.14 Release Notes. (BZ#837089, BZ#863285, BZ#863286)

This update fixes the following bugs:

• The Privacy Enhanced Mail (PEM) module initialization function did not return an error informing the caller that it is not thread-safe. Consequently, invalid writes were made resulting in unexpected terminations in multi-threaded libcurl-based applications. The PEM module initialization function now returns the PKCS #11 prescribed KR_CANT_LOCK constant when the type of locking requested by the caller for thread safety is not available. As a result, clients are informed of the lack of thread safety and can provide their own locking to prevent crashes. (BZ#555019)

• Due to a missing out-of-memory (OOM) check and improper freeing of allocated memory, the Privacy Enhanced Mail (PEM) module did not fully validate the encoding of certificates stored in a PEM-formatted file. As a consequence, error handling tests failed. With this update, the PEM module correctly validates the encoding, handles memory deallocation consistently, and error handling tests pass as expected. (BZ#827351)

Users of nss, nspr, and nss-util are advised to upgrade to these updated packages, which fix these bugs and add these enhancements. After installing this update, applications using NSS, NSPR, or nss-util must be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

Updated Packages

• nspr-devel-4.9.2-1.el6.i686.rpm
• nss-sysinit-3.14.0.0-12.el6.ppc64.rpm
• nss-devel-3.14.0.0-12.el6.x86_64.rpm
• nss-pkcs11-devel-3.14.0.0-12.el6.i686.rpm
• nss-util-3.14.0.0-2.el6.i686.rpm
• nss-tools-3.14.0.0-12.el6.s390x.rpm
• nss-tools-3.14.0.0-12.el6.i686.rpm
• nss-util-3.14.0.0-2.el6.ppc.rpm
• nss-util-devel-3.14.0.0-2.el6.s390.rpm
• nss-util-devel-3.14.0.0-2.el6.x86_64.rpm
• nss-debuginfo-3.14.0.0-12.el6.i686.rpm
• nss-debuginfo-3.14.0.0-12.el6.ppc64.rpm
• nss-util-devel-3.14.0.0-2.el6.ppc64.rpm
• nss-3.14.0.0-12.el6.ppc64.rpm
• nspr-4.9.2-1.el6.i686.rpm
• nss-debuginfo-3.14.0.0-12.el6.s390x.rpm
• nss-3.14.0.0-12.el6.s390.rpm
• nspr-devel-4.9.2-1.el6.s390x.rpm
• nss-util-debuginfo-3.14.0.0-2.el6.x86_64.rpm
• nss-util-3.14.0.0-2.el6.s390x.rpm
• nss-sysinit-3.14.0.0-12.el6.x86_64.rpm
• nss-debuginfo-3.14.0.0-12.el6.ppc.rpm
• nss-3.14.0.0-12.el6.s390x.rpm
• nss-sysinit-3.14.0.0-12.el6.s390x.rpm
• nss-pkcs11-devel-3.14.0.0-12.el6.x86_64.rpm
• nss-util-debuginfo-3.14.0.0-2.el6.ppc64.rpm
• nspr-4.9.2-1.el6.src.rpm
• nspr-debuginfo-4.9.2-1.el6.s390x.rpm
• nspr-4.9.2-1.el6.x86_64.rpm
• nss-util-3.14.0.0-2.el6.src.rpm
• nss-3.14.0.0-12.el6.i686.rpm
• nss-util-3.14.0.0-2.el6.ppc64.rpm
• nss-devel-3.14.0.0-12.el6.ppc64.rpm
• nss-debuginfo-3.14.0.0-12.el6.x86_64.rpm
• nspr-debuginfo-4.9.2-1.el6.x86_64.rpm
• nss-debuginfo-3.14.0.0-12.el6.s390.rpm
• nss-devel-3.14.0.0-12.el6.ppc.rpm
• nss-devel-3.14.0.0-12.el6.s390.rpm
• nspr-debuginfo-4.9.2-1.el6.s390.rpm
• nss-devel-3.14.0.0-12.el6.s390x.rpm
• nss-pkcs11-devel-3.14.0.0-12.el6.ppc64.rpm
• nspr-debuginfo-4.9.2-1.el6.i686.rpm
• nspr-devel-4.9.2-1.el6.s390.rpm
• nss-devel-3.14.0.0-12.el6.i686.rpm
• nspr-4.9.2-1.el6.ppc.rpm
• nss-util-debuginfo-3.14.0.0-2.el6.ppc.rpm
• nss-util-3.14.0.0-2.el6.x86_64.rpm
• nspr-4.9.2-1.el6.ppc64.rpm
• nss-pkcs11-devel-3.14.0.0-12.el6.ppc.rpm
• nss-3.14.0.0-12.el6.ppc.rpm
• nss-util-devel-3.14.0.0-2.el6.ppc.rpm
• nspr-4.9.2-1.el6.s390.rpm
• nspr-4.9.2-1.el6.s390x.rpm
• nspr-devel-4.9.2-1.el6.ppc64.rpm
• nss-util-devel-3.14.0.0-2.el6.s390x.rpm
• nss-pkcs11-devel-3.14.0.0-12.el6.s390x.rpm
• nss-util-3.14.0.0-2.el6.s390.rpm
• nspr-devel-4.9.2-1.el6.x86_64.rpm
• nss-tools-3.14.0.0-12.el6.ppc64.rpm
• nss-util-debuginfo-3.14.0.0-2.el6.s390.rpm
• nss-3.14.0.0-12.el6.x86_64.rpm
• nspr-devel-4.9.2-1.el6.ppc.rpm
• nss-util-debuginfo-3.14.0.0-2.el6.s390x.rpm
• nss-3.14.0.0-12.el6.src.rpm
• nss-util-devel-3.14.0.0-2.el6.i686.rpm
• nspr-debuginfo-4.9.2-1.el6.ppc.rpm
• nss-sysinit-3.14.0.0-12.el6.i686.rpm
• nspr-debuginfo-4.9.2-1.el6.ppc64.rpm
• nss-pkcs11-devel-3.14.0.0-12.el6.s390.rpm
• nss-util-debuginfo-3.14.0.0-2.el6.i686.rpm
• nss-tools-3.14.0.0-12.el6.x86_64.rpm

Fixes

• This content is not included.BZ - 811314
• This content is not included.BZ - 835970
• This content is not included.BZ - 863285
• This content is not included.BZ - 863286
• This content is not included.BZ - 872838

CVEs

(none)

References

• Content from developer.mozilla.org is not included.Content from developer.mozilla.org is not included.https://developer.mozilla.org/en-US/docs/NSS/NSS_3.14_release_notes

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.