RHBA-2013:1558 - Bug Fix Advisory

Topic

Updated nss and nspr packages that fix a number of bugs and add various
enhancements are now available for Red Hat Enterprise Linux 6.

Description

Network Security Services (NSS) is a set of libraries designed to support the
cross-platform development of security-enabled client and server applications.
Netscape Portable Runtime (NSPR) provides platform independence for non-GUI
operating system facilities.

The nss family of packages, consisting of nss, nss-softokn, and nss-util, has
been upgraded to the higher upstream versions, which provide a number of bug
fixes and enhancements over the previous versions:

• The nss package has been upgraded to the upstream version 3.15.1. (BZ#918950,

BZ#918950)

• The nss-softokn package has been upgraded to the upstream version 3.14.3

(BZ#919172)

• The nss-util package has been upgraded to the upstream version 3.15.1

(BZ#919174, BZ#919174)

The nspr package has been upgraded to upstream version 4.10, which provides a
number of bug fixes and enhancements over the previous version. (BZ#919180,
BZ#1002643)

These updated nss and nspr packages include numerous bug fixes and enhancements.
Space precludes documenting all of these changes in this advisory. Users are
directed to the Red Hat Enterprise Linux 6.5 Technical Notes for information on
the most significant of these changes:

https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Technical_Notes/nss-and-nspr.html#RHBA-2013-1558

Users of nss and nsrp are advised to upgrade to these updated packages, which
fix these issues and add these enhancements. After installing this update,
applications using NSS or NSPR must be restarted for this update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 882408 - NSS_NO_PKCS11_BYPASS must preserve API compatibility
• BZ - 903017 - Firefox hang when CAC/PIV smart card certificates are viewed in the certificate manager
• BZ - 905013 - NSPR pthread_key_t leak and memory corruption
• BZ - 918950 - [RFE][RHEL6] Rebase to nss-3.14.3 to fix the lucky-13 issue [6.5]
• BZ - 919172 - Rebase to nss-softokn 3.14.3 to fix the lucky-13 issue [6.5]
• BZ - 919174 - Rebase to nss-util 3.14.3 as part of the fix for the lucky-13 issue [rhel-6.5]
• BZ - 919180 - Rebase to nspr-4.9.5
• BZ - 950155 - missing partial RELRO [6.5]
• BZ - 960193 - Enable ECC in nss and nss-softoken
• BZ - 960208 - Enable ECC in nss-softoken [rhel-6.5.0]
• BZ - 975755 - nssutil_ReadSecmodDB() leaks memory [6.5]
• BZ - 976572 - Pick up various upstream GCM code fixes applied since nss-3.14.3 was released
• BZ - 977341 - nss-tools certutil -H does not list all options
• BZ - 988083 - [nss-util] Pick up various upstream GCM code fixes applied since nss-3.14.3 was released
• BZ - 990631 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS
• BZ - 1008534 - ipa server install failure on latest RHEL-65 build
• BZ - 1010224 - NSS 3.15 breaks SSL in OpenLDAP clients

CVEs

(none)

References

• https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/6.5_Technical_Notes/nss-and-nspr.html#RHBA-2013-1558