Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 616032 (CVE-2017-5461) - <dev-libs/nss-3.29.5: Out-of-bounds write in Base64 encoding in NSS
Summary: <dev-libs/nss-3.29.5: Out-of-bounds write in Base64 encoding in NSS
Status: RESOLVED FIXED
Alias: CVE-2017-5461
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A2 [glsa cve]
Keywords:
Depends on:
Blocks: CVE-2017-5462
  Show dependency tree
 
Reported: 2017-04-19 18:20 UTC by Thomas Deutschmann
Modified: 2017-08-09 02:00 UTC (History)
1 user (show)

See Also:
Package list:
=dev-libs/nss-3.29.5
Runtime testing required: ---
stable-bot: sanity-check+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Deutschmann gentoo-dev Security 2017-04-19 18:20:47 UTC
From https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/


CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS

Impact
    critical

Description

An out-of-bounds write during Base64 decoding operation in the Network
Security Services (NSS) library due to insufficient memory being
allocated to the buffer. This results in a potentially exploitable
crash. The NSS library has been updated to fix this issue to address
this issue and Firefox ESR 45.9 has been updated with
NSS version 3.21.4.
Comment 1 Ian Stakenvicius (RETIRED) gentoo-dev 2017-04-19 18:27:08 UTC
3.21.x has long been dropped from the gentoo repo, however I don't know what other versions of NSS may be affected.  The CVE hasn't actually been filed yet so i guess we will have to wait.
Comment 2 Thomas Deutschmann gentoo-dev Security 2017-04-19 18:29:46 UTC
Right, keep in mind that NSS version schema is complicated: I.e. just because 3.28.1 is higher than 3.21.4 you cannot be sure that it contains all the fixes from 3.21.4.

So yes, we have to wait for more information.
Comment 3 Ian Stakenvicius (RETIRED) gentoo-dev 2017-04-19 20:25:44 UTC
Addressed in >=dev-libs/nss-3.29.5 and >=dev-libs/nss-3.30.1

Arches, please stabilize dev-libs/nss-3.29.5 for target
KEYWORDS="alpha amd64 arm arm64 hppa ia64 ppc ppc64"
Comment 4 Tobias Klausmann gentoo-dev 2017-04-22 07:37:11 UTC
Stable on alpha.
Comment 5 Jeroen Roovers (RETIRED) gentoo-dev 2017-04-22 13:19:46 UTC
Stable for HPPA.
Comment 6 Agostino Sarubbo gentoo-dev 2017-04-23 10:32:48 UTC
amd64 stable
Comment 7 Agostino Sarubbo gentoo-dev 2017-04-27 10:42:09 UTC
x86 stable
Comment 8 Agostino Sarubbo gentoo-dev 2017-04-27 11:29:03 UTC
sparc stable
Comment 9 Agostino Sarubbo gentoo-dev 2017-04-29 15:06:02 UTC
ppc stable
Comment 10 Agostino Sarubbo gentoo-dev 2017-04-30 09:40:01 UTC
ppc64 stable
Comment 11 Yury German Gentoo Infrastructure gentoo-dev 2017-04-30 13:50:58 UTC
Remaining arches are not part of security supported architectures, please stabilize when you have a chance. 

New GLSA Request filed.
Comment 12 Markus Meier gentoo-dev 2017-05-04 20:03:53 UTC
arm stable
Comment 13 GLSAMaker/CVETool Bot gentoo-dev 2017-05-07 20:29:14 UTC
This issue was resolved and addressed in
 GLSA 201705-04 at https://security.gentoo.org/glsa/201705-04
by GLSA coordinator Thomas Deutschmann (whissi).
Comment 14 Thomas Deutschmann gentoo-dev Security 2017-05-07 20:30:22 UTC
Re-opening for ia64 and cleanup.
Comment 15 Yury German Gentoo Infrastructure gentoo-dev 2017-05-09 06:01:56 UTC
ia64 please stabilize or move to ~ia64

Maintainer(s), please drop the vulnerable version(s).
Comment 16 Agostino Sarubbo gentoo-dev 2017-06-10 15:16:04 UTC
ia64 stable.

Maintainer(s), please cleanup.
Comment 17 Yury German Gentoo Infrastructure gentoo-dev 2017-07-04 21:30:16 UTC
Maintainer(s), please drop the vulnerable version(s).
Comment 18 Lars Wendler (Polynomial-C) gentoo-dev 2017-07-05 09:25:55 UTC
commit d20959fb60e5947f9dab5874e9ac52314b7fb542
Author: Lars Wendler <polynomial-c@gentoo.org>
Date:   Wed Jul 5 11:22:52 2017

    dev-libs/nss: Security cleanup for bug #616032
Comment 19 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2017-08-09 02:00:08 UTC
(In reply to Lars Wendler (Polynomial-C) from comment #18)
> commit d20959fb60e5947f9dab5874e9ac52314b7fb542
> Author: Lars Wendler <polynomial-c@gentoo.org>
> Date:   Wed Jul 5 11:22:52 2017
> 
>     dev-libs/nss: Security cleanup for bug #616032

Thank you.