RHBA-2013:0081 - Bug Fix Advisory

Topic

Updated nss and nspr packages that fix two bugs and add one enhancement are now
available for Red Hat Enterprise Linux 5.

Description

Network Security Services (NSS) is a set of libraries designed to support the
cross-platform development of security-enabled client and server applications.
Netscape Portable Runtime (NSPR) provides platform independence for non-GUI
operating system facilities.

This update fixes the following bugs:

• Due to errors in the Netscape Portable Runtime (NSPR) code responsible for

thread synchronization, memory corruption sometimes occurred. Consequently, the
web server daemon (httpd) sometimes terminated unexpectedly with a segmentation
fault after making more than 1023 calls to the NSPR library. With this update,
an improvement to the way NSPR frees previously allocated memory has been made
and httpd no longer crashes in the scenario described. (BZ#633519)

• Some Network Security Services (NSS) clients call NSS without initializing

first as mandated by the API and NSS did not protect itself against such
improper usage. Consequently, this caused unexpected terminations on shutdown as
some variables had not been properly initialized. Such crashes were reported in
the messaging daemon (qpidd), included in Red Hat Enterprise MRG, after a recent
update to the nss package. This occurred as qpidd made NSS calls before
initializing NSS. With this update, NSS now protects itself against potential
improper use by client code. As a result, NSS prevents qpidd, and other
processes that may call NSS without initializing as mandated by the API, from
crashing. (BZ#797939)

This update also adds the following enhancement:

• The certutil tool was enhanced to support creation of Elliptic Curve (EC) key

pairs on Hardware Security Modules. (BZ#820684)

All nss and nspr users should upgrade to these updated packages, which fix these
bugs and add this enhancement. After installing the update, applications using
NSS and NSPR must be restarted for the changes to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 633519 - NSPR pthread_key_t leak and memory corruption
• BZ - 788039 - rebase nss to make firefox 10 LTS rebase possible
• BZ - 797939 - Qpid AMQP daemon fails to load after latest updates
• BZ - 820684 - certutil support for EC on HSMs - need to call PK11_GenerateKeyPairWithOpFlags()
• BZ - 830304 - Update RHEL 5.x to NSS 3.13.5 for Mozilla 10.0.6
• BZ - 831654 - Update RHEL 5.x to NSPR 4.9.1 for Mozilla 10.0.6

CVEs

(none)

References

(none)