The NSS Development Team announces the release of NSS 3.19.2.3, which is a security patch release for NSS 3.19.2.
(Current users of NSS 3.19.3, NSS 3.19.4 or NSS 3.20.x are advised to update to NSS 3.21.1, NSS 3.22.2, or a later release.) No new functionality is introduced in this release. The following security-relevant bug has been resolved in NSS 3.19.2.3. Users are encouraged to upgrade immediately. * Bug 1245528 (CVE-2016-1950): Fixed a heap-based buffer overflow related to the parsing of certain ASN.1 structures. An attacker could create a specially-crafted certificate which, when parsed by NSS, would cause a crash or execution of arbitrary code with the permissions of the user. The full release notes are available at https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.2.3_release_notes The HG tag is NSS_3_19_2_3_RTM. NSS 3.19.2.3 requires NSPR 4.10.10 or newer. NSS 3.19.2.3 source distributions are available on ftp.mozilla.org for secure HTTPS download: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_19_2_3_RTM/src/ The NSS development team would like to thank security researcher Francis Gabriel for responsibly disclosing the issue in Bug 1245528. -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
