[SECURITY] [DLA 971-1] nss security update

2017-05-3120:28:03

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.032 Low

EPSS

Percentile

91.1%

JSON

Package : nss
Version : 2:3.26-1+debu7u4
CVE ID : CVE-2017-7502
Debian Bug : 863839

CVE-2017-7502

A null pointer dereference vulnerability in NSS was found when server
receives empty SSLv2 messages. This issue was introduced with the recent
removal of SSLv2 protocol from upstream code in 3.24.0 and introduction
of dedicated parser able to handle just sslv2-style hello messages.

For Debian 7 "Wheezy", this problem has been fixed in version
2:3.26-1+debu7u4.

We recommend that you upgrade your nss packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-------------- Ola Lundqvist --------------------
/ [email protected] GPG fingerprint
| [email protected] 22F2 32C6 B1E0 F4BF 2B26 |

http://inguza.com/ 0A6A 5E90 DCFA 9426 876F /

OSVersionArchitecturePackageVersionFilename
Debian7i386libnss3-dbg< 2:3.26-1+debu7u4libnss3-dbg_2:3.26-1+debu7u4_i386.deb
Debian8kfreebsd-i386libnss3-1d< 2:3.26-1+debu8u2libnss3-1d_2:3.26-1+debu8u2_kfreebsd-i386.deb
Debian8mipsellibnss3-tools< 2:3.26-1+debu8u2libnss3-tools_2:3.26-1+debu8u2_mipsel.deb
Debian8powerpclibnss3< 2:3.26-1+debu8u2libnss3_2:3.26-1+debu8u2_powerpc.deb
Debian8kfreebsd-amd64libnss3-tools< 2:3.26-1+debu8u2libnss3-tools_2:3.26-1+debu8u2_kfreebsd-amd64.deb
Debian7armellibnss3-1d< 2:3.26-1+debu7u4libnss3-1d_2:3.26-1+debu7u4_armel.deb
Debian8allnss< 2:3.26-1+debu8u2nss_2:3.26-1+debu8u2_all.deb
Debian7armellibnss3< 2:3.26-1+debu7u4libnss3_2:3.26-1+debu7u4_armel.deb
Debian8ppc64ellibnss3-dev< 2:3.26-1+debu8u2libnss3-dev_2:3.26-1+debu8u2_ppc64el.deb
Debian8amd64libnss3-dbg< 2:3.26-1+debu8u2libnss3-dbg_2:3.26-1+debu8u2_amd64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	i386	libnss3-dbg	< 2:3.26-1+debu7u4	libnss3-dbg_2:3.26-1+debu7u4_i386.deb
Debian	8	kfreebsd-i386	libnss3-1d	< 2:3.26-1+debu8u2	libnss3-1d_2:3.26-1+debu8u2_kfreebsd-i386.deb
Debian	8	mipsel	libnss3-tools	< 2:3.26-1+debu8u2	libnss3-tools_2:3.26-1+debu8u2_mipsel.deb
Debian	8	powerpc	libnss3	< 2:3.26-1+debu8u2	libnss3_2:3.26-1+debu8u2_powerpc.deb
Debian	8	kfreebsd-amd64	libnss3-tools	< 2:3.26-1+debu8u2	libnss3-tools_2:3.26-1+debu8u2_kfreebsd-amd64.deb
Debian	7	armel	libnss3-1d	< 2:3.26-1+debu7u4	libnss3-1d_2:3.26-1+debu7u4_armel.deb
Debian	8	all	nss	< 2:3.26-1+debu8u2	nss_2:3.26-1+debu8u2_all.deb
Debian	7	armel	libnss3	< 2:3.26-1+debu7u4	libnss3_2:3.26-1+debu7u4_armel.deb
Debian	8	ppc64el	libnss3-dev	< 2:3.26-1+debu8u2	libnss3-dev_2:3.26-1+debu8u2_ppc64el.deb
Debian	8	amd64	libnss3-dbg	< 2:3.26-1+debu8u2	libnss3-dbg_2:3.26-1+debu8u2_amd64.deb