[ASA-202112-3] nss: arbitrary code execution

[Jonas Witschel]

Arch Linux Security Advisory ASA-202112-3
=========================================

Severity: High
Date    : 2021-12-03
CVE-ID  : CVE-2021-43527
Package : nss
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-2596

Summary
=======

The package nss before version 3.73-1 is vulnerable to arbitrary code
execution.

Resolution
==========

Upgrade to 3.73-1.

# pacman -Syu "nss>=3.73-1"

The problem has been fixed upstream in version 3.73.

Workaround
==========

None.

Description
===========

NSS (Network Security Services) versions prior to 3.73 are vulnerable
to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures.
Applications using NSS for handling signatures encoded within CMS,
S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications
using NSS for certificate validation or other TLS, X.509, OCSP or CRL
functionality may be impacted, depending on how they configure NSS.

Note: This vulnerability does NOT impact Mozilla Firefox. However,
email clients and PDF viewers that use NSS for signature verification,
such as Thunderbird, LibreOffice, Evolution and Evince are believed to
be impacted.

Impact
======

A remote attacker could execute arbitrary code through crafted
signatures.

References
==========

https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/#CVE-2021-43527
https://bugs.chromium.org/p/project-zero/issues/detail?id=2237
https://bugzilla.mozilla.org/show_bug.cgi?id=1737470
https://hg.mozilla.org/projects/nss/rev/6b3dc97a8767d9dc5c4c181597d1341d0899aa58
https://security.archlinux.org/CVE-2021-43527
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20211206/167e2d7c/attachment.sig>