Security
Headlines
HeadlinesLatestCVEs

Headline

Red Hat Security Advisory 2023-1332-01

Red Hat Security Advisory 2023-1332-01 - Network Security Services is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Packet Storm
#vulnerability#linux#red_hat#js#php#firefox

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: nss security update
Advisory ID: RHSA-2023:1332-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1332
Issue date: 2023-03-20
CVE Names: CVE-2023-0767
====================================================================

  1. Summary:

An update for nss is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64

  1. Description:

Network Security Services (NSS) is a set of libraries designed to support
the cross-platform development of security-enabled client and server
applications.

Security Fix(es):

  • nss: Arbitrary memory write via PKCS 12 (CVE-2023-0767)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

  1. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, applications using NSS (for example, Firefox)
must be restarted for this update to take effect.

  1. Bugs fixed (https://bugzilla.redhat.com/):

2170377 - CVE-2023-0767 nss: Arbitrary memory write via PKCS 12

  1. Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
nss-3.79.0-5.el7_9.src.rpm

x86_64:
nss-3.79.0-5.el7_9.i686.rpm
nss-3.79.0-5.el7_9.x86_64.rpm
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-sysinit-3.79.0-5.el7_9.x86_64.rpm
nss-tools-3.79.0-5.el7_9.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

x86_64:
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-devel-3.79.0-5.el7_9.i686.rpm
nss-devel-3.79.0-5.el7_9.x86_64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.i686.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
nss-3.79.0-5.el7_9.src.rpm

x86_64:
nss-3.79.0-5.el7_9.i686.rpm
nss-3.79.0-5.el7_9.x86_64.rpm
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-sysinit-3.79.0-5.el7_9.x86_64.rpm
nss-tools-3.79.0-5.el7_9.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

x86_64:
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-devel-3.79.0-5.el7_9.i686.rpm
nss-devel-3.79.0-5.el7_9.x86_64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.i686.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
nss-3.79.0-5.el7_9.src.rpm

ppc64:
nss-3.79.0-5.el7_9.ppc.rpm
nss-3.79.0-5.el7_9.ppc64.rpm
nss-debuginfo-3.79.0-5.el7_9.ppc.rpm
nss-debuginfo-3.79.0-5.el7_9.ppc64.rpm
nss-devel-3.79.0-5.el7_9.ppc.rpm
nss-devel-3.79.0-5.el7_9.ppc64.rpm
nss-sysinit-3.79.0-5.el7_9.ppc64.rpm
nss-tools-3.79.0-5.el7_9.ppc64.rpm

ppc64le:
nss-3.79.0-5.el7_9.ppc64le.rpm
nss-debuginfo-3.79.0-5.el7_9.ppc64le.rpm
nss-devel-3.79.0-5.el7_9.ppc64le.rpm
nss-sysinit-3.79.0-5.el7_9.ppc64le.rpm
nss-tools-3.79.0-5.el7_9.ppc64le.rpm

s390x:
nss-3.79.0-5.el7_9.s390.rpm
nss-3.79.0-5.el7_9.s390x.rpm
nss-debuginfo-3.79.0-5.el7_9.s390.rpm
nss-debuginfo-3.79.0-5.el7_9.s390x.rpm
nss-devel-3.79.0-5.el7_9.s390.rpm
nss-devel-3.79.0-5.el7_9.s390x.rpm
nss-sysinit-3.79.0-5.el7_9.s390x.rpm
nss-tools-3.79.0-5.el7_9.s390x.rpm

x86_64:
nss-3.79.0-5.el7_9.i686.rpm
nss-3.79.0-5.el7_9.x86_64.rpm
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-devel-3.79.0-5.el7_9.i686.rpm
nss-devel-3.79.0-5.el7_9.x86_64.rpm
nss-sysinit-3.79.0-5.el7_9.x86_64.rpm
nss-tools-3.79.0-5.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

ppc64:
nss-debuginfo-3.79.0-5.el7_9.ppc.rpm
nss-debuginfo-3.79.0-5.el7_9.ppc64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.ppc.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.ppc64.rpm

ppc64le:
nss-debuginfo-3.79.0-5.el7_9.ppc64le.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.ppc64le.rpm

s390x:
nss-debuginfo-3.79.0-5.el7_9.s390.rpm
nss-debuginfo-3.79.0-5.el7_9.s390x.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.s390.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.s390x.rpm

x86_64:
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.i686.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
nss-3.79.0-5.el7_9.src.rpm

x86_64:
nss-3.79.0-5.el7_9.i686.rpm
nss-3.79.0-5.el7_9.x86_64.rpm
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-devel-3.79.0-5.el7_9.i686.rpm
nss-devel-3.79.0-5.el7_9.x86_64.rpm
nss-sysinit-3.79.0-5.el7_9.x86_64.rpm
nss-tools-3.79.0-5.el7_9.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

x86_64:
nss-debuginfo-3.79.0-5.el7_9.i686.rpm
nss-debuginfo-3.79.0-5.el7_9.x86_64.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.i686.rpm
nss-pkcs11-devel-3.79.0-5.el7_9.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2023-0767
https://access.redhat.com/security/updates/classification/#important

  1. Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZBh4d9zjgjWX9erEAQi0VA/9EDOjHMY594bv+AZ4cg4w1wAKFyh+3m+j
jyOn0aHNkLFAXyHixGKeANhURkvQ6MG2CWVz/2idzPWvrVBMAmN26OXOJI7MmOve
AZPPt+kK83ec+PAdNLRKDWlMXx/C7YxIDlMolC3vsHs8GFOh07sQSl+qCgCUsoqL
wULhFZoxfjvMRM7PNsXYrjWhOQkbCZYudbp3sXhWXNcMFGttR2I51f0AVWvVl1P1
JPwVBlEK0EphYWNncr2zQphP6zWLPyl0B0o+7O/M5a/bkXrAN13ShHv8N06Rmxry
XFWJTk9DyPQljYK2dYJjo0N/9zDKouXwdTxuwoxPYhrFgsy+VKEFp47oFUlrzLB6
x5pdDarqpdcOkPFNZuRjuBw2RbMozWkoy+JajW7NXFz3XYZky9B95RZSNI2lHhdQ
cwqJ2aZSAgOJMexcxPxkiwkE4l2V82yYBEHgkf2/6/HZSoYCFZtYJKF5miPaMNYY
nhbc2w6Z3aQ78C5jS9wqdVsJsCpVPflwRq8FXUO0bAB91VG/GvqAIdH/VhxAlXy5
5h2g/skrFCTAR9iKE4AWm5uk1mPN/tTQa7eHY7fx/fA3cTm46Jd/5am0w8IhZHoq
I1X6fJzE3WMg4AZ6y/BAiVSTxolLhepNy3zdCP8cpyK+aMDipPimw8rddTayiEaU
1y2vLw5oCe4=ZIU4
-----END PGP SIGNATURE-----

RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

CVE-2023-22062: Oracle Critical Patch Update Advisory - July 2023

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The supported version that is affected is 11.2.13.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Reporting. While the vulnerability is in Oracle Hyperion Financial Reporting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Reporting accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Reporting. CVSS 3.1 Base Score 8.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L).

Gentoo Linux Security Advisory 202305-35

Gentoo Linux Security Advisory 202305-35 - Multiple vulnerabilities have been discovered in Mozilla Firefox, the worst of which could result in arbitrary code execution. Versions greater than or equal to 102.10.0:esr are affected.

Red Hat Security Advisory 2023-2061-01

Red Hat Security Advisory 2023-2061-01 - Multicluster Engine for Kubernetes 2.1.6 images Multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy. Issues addressed include a denial of service vulnerability.

RHSA-2023:1677: Red Hat Security Advisory: Red Hat Virtualization Host 4.4.z SP 1 security update batch#5 (oVirt-4.5.3-5)

An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-23521: A flaw was found in Git, a distributed revision control system. When parsing gitattributes, a mechanism to allow defining attributes for paths, multiple integer overflows can occur when there is a huge number of path patterns, attributes for a single pattern, ...

Red Hat Security Advisory 2023-1392-01

Red Hat Security Advisory 2023-1392-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.10.55.

Red Hat Security Advisory 2023-1406-01

Red Hat Security Advisory 2023-1406-01 - Network Security Services is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

RHSA-2023:1332: Red Hat Security Advisory: nss security update

An update for nss is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0767: The Mozilla Foundation Security Advisory describes this flaw as: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled.

Red Hat Security Advisory 2023-0817-01

Red Hat Security Advisory 2023-0817-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.8.0. Issues addressed include a use-after-free vulnerability.

Red Hat Security Advisory 2023-0824-01

Red Hat Security Advisory 2023-0824-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.8.0. Issues addressed include a use-after-free vulnerability.

Debian Security Advisory 5355-1

Debian Linux Security Advisory 5355-1 - Multiple security issues were discovered in Thunderbird, which could result in denial of service or the execution of arbitrary code.

Debian Security Advisory 5353-1

Debian Linux Security Advisory 5353-1 - Christian Holler discovered that incorrect handling of PKCS 12 Safe Bag attributes in nss, the Mozilla Network Security Service library, may result in execution of arbitrary code if a specially crafted PKCS 12 certificate bundle is processed.

RHSA-2023:0820: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0616: The Mozilla Foundation Security Advisory describes this flaw as: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacke...

RHSA-2023:0821: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0616: The Mozilla Foundation Security Advisory describes this flaw as: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacker could send a crafted mes...

RHSA-2023:0823: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0616: The Mozilla Foundation Security Advisory describes this flaw as: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and display the message, which could cause Thunderbird's user interface to lock up and no longer respond to the user's actions. An attacke...

RHSA-2023:0819: Red Hat Security Advisory: thunderbird security update

An update for thunderbird is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0616: The Mozilla Foundation Security Advisory describes this flaw as: If a MIME email combines OpenPGP and OpenPGP MIME data in a certain way Thunderbird repeatedly attempts to process and di...

RHSA-2023:0808: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2023-0767: The Mozilla Foundation Security Advisory describes this flaw as: An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mishandled. * CVE-2023-25728: The Mozilla Foundation Security Advisory describes this flaw as: The `Content-Security-Policy-Report-Only`...

Packet Storm: Latest News

CUPS IPP Attributes LAN Remote Code Execution