Slackware64-14.0 ChangeLog (2021-12-03)

Fri Dec 3 20:07:20 UTC 2021

  • patches/packages/mozilla-nss-3.23-x86_64-2_slack14.0.txz
    This update fixes a critical security issue:
    NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are
    vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS
    signatures. Applications using NSS for handling signatures encoded within
    CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications
    using NSS for certificate validation or other TLS, X.509, OCSP or CRL
    functionality may be impacted, depending on how they configure NSS.
    Note: This vulnerability does NOT impact Mozilla Firefox. However, email
    clients and PDF viewers that use NSS for signature verification, such as
    Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.
    Thanks to Tavis Ormandy of Google Project Zero.
    For more information, see:
    https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43527
    (* Security fix *)
  • news/2021/12/03/slackware64-14.0-changelog.txt
  • Last modified: 7 weeks ago
  • by Giuseppe Di Terlizzi