Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
  • Products & Services

    Products

    Support

    • Production Support
    • Development Support
    • Product Life Cycles

    Services

    • Consulting
    • Technical Account Management
    • Training & Certifications

    Documentation

    • Red Hat Enterprise Linux
    • Red Hat JBoss Enterprise Application Platform
    • Red Hat OpenStack Platform
    • Red Hat OpenShift Container Platform
    All Documentation

    Ecosystem Catalog

    • Red Hat Partner Ecosystem
    • Partner Resources
  • Tools

    Tools

    • Troubleshoot a product issue
    • Packages
    • Errata

    Customer Portal Labs

    • Configuration
    • Deployment
    • Security
    • Troubleshoot
    All labs

    Red Hat Insights

    Increase visibility into IT operations to detect and resolve technical issues before they impact your business.

    Learn More
    Go to Insights
  • Security

    Red Hat Product Security Center

    Engage with our Red Hat Product Security team, access security updates, and ensure your environments are not exposed to any known security vulnerabilities.

    Product Security Center

    Security Updates

    • Security Advisories
    • Red Hat CVE Database
    • Security Labs

    Keep your systems secure with Red Hat's specialized responses to security vulnerabilities.

    View Responses

    Resources

    • Security Blog
    • Security Measurement
    • Severity Ratings
    • Backporting Policies
    • Product Signing (GPG) Keys
  • Community

    Customer Portal Community

    • Discussions
    • Private Groups
    Community Activity

    Customer Events

    • Red Hat Convergence
    • Red Hat Summit

    Stories

    • Red Hat Subscription Value
    • You Asked. We Acted.
    • Open Source Communities
Or troubleshoot an issue.

Select Your Language

  • English
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat CodeReady Workspaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Integration
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
  • Red Hat JBoss Data Virtualization
  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager
All Products
Red Hat Product Errata RHSA-2017:1103 - Security Advisory
Issued:
2017-04-20
Updated:
2017-04-20

RHSA-2017:1103 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Critical: nss security update

Type/Severity

Security Advisory: Critical

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for nss is now available for Red Hat Enterprise Linux 5.9 Long Life.

Red Hat Product Security has rated this update as having a security impact of
Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a
detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Description

Network Security Services (NSS) is a set of libraries designed to support the
cross-platform development of security-enabled client and server applications.

Security Fix(es):

  • An out-of-bounds write flaw was found in the way NSS performed certain

Base64-decoding operations. An attacker could use this flaw to create a
specially crafted certificate which, when parsed by NSS, could cause it to crash
or execute arbitrary code, using the permissions of the user running an
application compiled against the NSS library. (CVE-2017-5461)

Red Hat would like to thank the Mozilla project for reporting this issue.
Upstream acknowledges Ronald Crane as the original reporter.

Solution

For details on how to apply this update, which includes the changes described in
this advisory, refer to:

https://access.redhat.com/articles/11258

After installing this update, applications using NSS (for example, Firefox) must
be restarted for this update to take effect.

Affected Products

  • Red Hat Enterprise Linux Server - AUS 5.9 x86_64
  • Red Hat Enterprise Linux Server - AUS 5.9 ia64
  • Red Hat Enterprise Linux Server - AUS 5.9 i386

Fixes

  • BZ - 1440080 - CVE-2017-5461 nss: Write beyond bounds caused by bugs in Base64 de/encoding in nssb64d.c and nssb64e.c (MFSA 2017-10)

CVEs

  • CVE-2017-5461

References

  • https://access.redhat.com/security/updates/classification/#critical
Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux Server - AUS 5.9

SRPM
nss-3.14.3-11.el5_9.src.rpm SHA-256: 1c852de60bdd4166b788a36931c517aba03d058c7bac4c851ce8d3caa3aef110
x86_64
nss-3.14.3-11.el5_9.i386.rpm SHA-256: bcf8caecf6c3ee0969c83df38bdace85f8b10b5a2f30ccc05a41871527872659
nss-3.14.3-11.el5_9.x86_64.rpm SHA-256: ef601c3cf0d217714e96962608ee11a1113f9717da4e303a13d85dabb446778c
nss-debuginfo-3.14.3-11.el5_9.i386.rpm SHA-256: 2e7716a5cfac1fa553d7c092f7fb53575beb278a07ee1b1a00d9e8a5ca9f7d58
nss-debuginfo-3.14.3-11.el5_9.x86_64.rpm SHA-256: 4da3fa3ac0132f92a939066464d70446cd89a817fb309726ee50dc2072b6e568
nss-devel-3.14.3-11.el5_9.i386.rpm SHA-256: 94f6efb2edd3c6fea3c11f6bf6866b3c5c390fce3ae941f3a80150df22a60df6
nss-devel-3.14.3-11.el5_9.x86_64.rpm SHA-256: d643b4ae422f4ea6ce0a1eea4e5592d487d81a3bbadb823866ae46141b00a3e1
nss-pkcs11-devel-3.14.3-11.el5_9.i386.rpm SHA-256: f8fadeb27b769417c64f5b39b009c35699bb174e99ef7173f757c3038f61318c
nss-pkcs11-devel-3.14.3-11.el5_9.x86_64.rpm SHA-256: 2af3f2be99ae73f308ca27bd5255b2652a0c219092df3b414a21d5531b0558fa
nss-tools-3.14.3-11.el5_9.x86_64.rpm SHA-256: d10e91e422e046552e5c9ff1ff44da07ff8369a3238036474bc83d78e1d978a5
ia64
nss-3.14.3-11.el5_9.i386.rpm SHA-256: bcf8caecf6c3ee0969c83df38bdace85f8b10b5a2f30ccc05a41871527872659
nss-3.14.3-11.el5_9.ia64.rpm SHA-256: d37b7785c60f8fc553d00b9c1a590ab18a18e8c5ecc19bde88cbaf4409c66bd6
nss-debuginfo-3.14.3-11.el5_9.i386.rpm SHA-256: 2e7716a5cfac1fa553d7c092f7fb53575beb278a07ee1b1a00d9e8a5ca9f7d58
nss-debuginfo-3.14.3-11.el5_9.ia64.rpm SHA-256: 7b6326c8657139f38beb6aefa7b7e70b6a26d31ca55e9ed9eff204a6f60459c5
nss-devel-3.14.3-11.el5_9.ia64.rpm SHA-256: 3997b00ec5f09c7ce7d42dfaa51208c1c0a3b41cae1611a984f331bda3b3d244
nss-pkcs11-devel-3.14.3-11.el5_9.ia64.rpm SHA-256: b3f2eda95a48c29737721b94c1c526ce144fdde3079c01588fc5127555777528
nss-tools-3.14.3-11.el5_9.ia64.rpm SHA-256: 791ba2ad05891002db5cf73f1e3e7223aa4111185ba80dc716ffe80ccc105435
i386
nss-3.14.3-11.el5_9.i386.rpm SHA-256: bcf8caecf6c3ee0969c83df38bdace85f8b10b5a2f30ccc05a41871527872659
nss-debuginfo-3.14.3-11.el5_9.i386.rpm SHA-256: 2e7716a5cfac1fa553d7c092f7fb53575beb278a07ee1b1a00d9e8a5ca9f7d58
nss-devel-3.14.3-11.el5_9.i386.rpm SHA-256: 94f6efb2edd3c6fea3c11f6bf6866b3c5c390fce3ae941f3a80150df22a60df6
nss-pkcs11-devel-3.14.3-11.el5_9.i386.rpm SHA-256: f8fadeb27b769417c64f5b39b009c35699bb174e99ef7173f757c3038f61318c
nss-tools-3.14.3-11.el5_9.i386.rpm SHA-256: 200d0b35a7f442e327effef2daec344a0bada452a0c6d1ea516146ca8b241d99

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

About

  • Red Hat Subscription Value
  • About Red Hat
  • Red Hat Jobs
2023
  • Privacy Statement
  • Customer Portal Terms of Use
  • All Policies and Guidelines
Twitter Facebook