git: 30e0367d305e - main - security/vuxml: Record NSS vulnerability
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Thu, 02 Dec 2021 13:58:54 UTC
The branch main has been updated by brnrd:
URL: https://cgit.FreeBSD.org/ports/commit/?id=30e0367d305e770dd0d89a8e2c917470271a5167
commit 30e0367d305e770dd0d89a8e2c917470271a5167
Author: Bernard Spil <brnrd@FreeBSD.org>
AuthorDate: 2021-12-02 13:58:50 +0000
Commit: Bernard Spil <brnrd@FreeBSD.org>
CommitDate: 2021-12-02 13:58:50 +0000
security/vuxml: Record NSS vulnerability
---
security/vuxml/vuln-2021.xml | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git a/security/vuxml/vuln-2021.xml b/security/vuxml/vuln-2021.xml
index 5eff6e567470..21a5edac66a7 100644
--- a/security/vuxml/vuln-2021.xml
+++ b/security/vuxml/vuln-2021.xml
@@ -1,3 +1,36 @@
+ <vuln vid="47695a9c-5377-11ec-8be6-d4c9ef517024">
+ <topic>NSS -- Memory corruption</topic>
+ <affects>
+ <package>
+ <name>nss</name>
+ <range><lt>3.73</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>The Mozilla project reports:</p>
+ <blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/">
+ <p>Memory corruption in NSS via DER-encoded DSA and RSA-PSS signatures (Critical)</p>
+ <p>NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR
+ are vulnerable to a heap overflow when handling DER-encoded DSA or
+ RSA-PSS signatures. Applications using NSS for handling signatures
+ encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be
+ impacted. Applications using NSS for certificate validation or other
+ TLS, X.509, OCSP or CRL functionality may be impacted, depending on
+ how they configure NSS.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2021-43527</cvename>
+ <url>https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/</url>
+ </references>
+ <dates>
+ <discovery>2021-12-01</discovery>
+ <entry>2021-12-02</entry>
+ </dates>
+ </vuln>
+
<vuln vid="0d6efbe3-52d9-11ec-9472-e3667ed6088e">
<topic>mailman < 2.1.38 -- CSRF vulnerability of list mod or member against list admin page</topic>
<affects>