drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in NSS
Name: |
Ausführen beliebiger Kommandos in NSS |
|
ID: |
USN-5168-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 21.04, Ubuntu 21.10 |
|
Datum: |
Do, 2. Dezember 2021, 00:34 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43527 |
|
Applikationen: |
NSS |
|
Originalnachricht |
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============1442771401004231487== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="aYJao2fUkOXCos7rETwbSLgDFVuZ6yas7"
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --aYJao2fUkOXCos7rETwbSLgDFVuZ6yas7 Content-Type: multipart/mixed; boundary="ZsQ5PIVR7YtZIyFfJsG48KS28rD9i8st1"; protected-headers="v1" From: Marc Deslauriers <marc.deslauriers@canonical.com> Reply-To: Ubuntu Security <security@ubuntu.com> To: "ubuntu-security-announce@lists.ubuntu.com" <ubuntu-security-announce@lists.ubuntu.com> Message-ID: <932e6e30-c0a1-a1f3-5efa-e3aa0c25e3f3@canonical.com> Subject: [USN-5168-1] NSS vulnerability
--ZsQ5PIVR7YtZIyFfJsG48KS28rD9i8st1 Content-Type: text/plain; charset=utf-8 Content-Language: en-C Content-Transfer-Encoding: quoted-printable
========================================================================== Ubuntu Security Notice USN-5168-1 December 01, 2021
nss vulnerability ==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 21.10 - Ubuntu 21.04 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS
Summary:
NSS could be made to crash or run programs if it verified a specially crafted signature.
Software Description: - nss: Network Security Service library
Details:
Tavis Ormandy discovered that NSS incorrectly handled verifying DSA/RSA-PSS signatures. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following package versions:
Ubuntu 21.10: libnss3 2:3.68-1ubuntu1.1
Ubuntu 21.04: libnss3 2:3.61-1ubuntu2.1
Ubuntu 20.04 LTS: libnss3 2:3.49.1-1ubuntu1.6
Ubuntu 18.04 LTS: libnss3 2:3.35-2ubuntu2.13
After a standard system update you need to restart any applications that use NSS, such as Evolution, to make all the necessary changes.
References: https://ubuntu.com/security/notices/USN-5168-1 CVE-2021-43527
Package Information: https://launchpad.net/ubuntu/+source/nss/2:3.68-1ubuntu1.1 https://launchpad.net/ubuntu/+source/nss/2:3.61-1ubuntu2.1 https://launchpad.net/ubuntu/+source/nss/2:3.49.1-1ubuntu1.6 https://launchpad.net/ubuntu/+source/nss/2:3.35-2ubuntu2.13
--ZsQ5PIVR7YtZIyFfJsG48KS28rD9i8st1--
--aYJao2fUkOXCos7rETwbSLgDFVuZ6yas7 Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature"
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmGns6cACgkQZWnYVadE vpNmfg/8DceOzea39YzPmJo+8PTqc3ZiZi684NPoKw2QySP5ZA6WZ/ihuoIvYH0L Q7cJqIk4aCwoRueegib7pEO1wHHlA5kRbbv7EpzUxfclYOQ75fEykvNMc6g5gXcA qZF+Jd3q4O4oSuST3ZsS5eZdDOq/B4BTbbzYpBUyqv2mRXFixKWfGKZv8QYMqKfq Ih0EADQGcLccJ9es+2kq9vrmRzAGxe2ObSyQvE9xb8FMGRM3dPEGkdaPZaJrmtU3 4A+Mgsx7hV38XKWYkFIftNdmfe4QZ057XPNUO8gHh9qLe+eeJwp/WmVqY2EAIY9S NHjmQg/Rq5b5nq5CwPnFHqURzjpMiykSOcJYtanLKFLPSFWhRWik/HW+xQInNLZz icyCUgEb6LHNAsBq4aZZCir4NkJw9u9KiajvBH8nzn6yVCj7z0AFm176wSwzNxhu QBlfWwc0M9acTEynvpJphoV+bN3Rt9x/laXKXsxK0sbQMPnWWzkrZw8ykMRz6D91 pWrRQRDHBWVxWl2QQUMmyo+nyTcBeKpTawmVc9YlnjOb4+gTlOJBsY9i6/qmj4Ef Q1ZKfoc3V6UZB4GLgQRuWkxHlQ0PrPq7cbXfZmVJWlmKdBYFxgOCSYmhX4/24r66 a/y+bXW/aaKYKwXeCeOLgFZ3LjuilrGn8YZrbT5nd7i03vKwF+Y= =YCdQ -----END PGP SIGNATURE-----
--aYJao2fUkOXCos7rETwbSLgDFVuZ6yas7--
--===============1442771401004231487== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline
LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5 LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj dXJpdHktYW5ub3VuY2UK
--===============1442771401004231487==--
|
|
|
|