[ANNOUNCE] NSS 3.22.2 Release
Kai Engert <[email protected]>
| Newsgroups | gmane.comp.mozilla.crypto |
|---|---|
| Message-ID | <[email protected]> |
The NSS Development Team announces the release of NSS 3.22.2, which is a security patch release for NSS 3.22. No new functionality is introduced in this release. The following security-relevant bug has been resolved in NSS 3.22.2. Users are encouraged to upgrade immediately. * Bug 1245528 (CVE-2016-1950): Fixed a heap-based buffer overflow related to the parsing of certain ASN.1 structures. An attacker could create a specially-crafted certificate which, when parsed by NSS, would cause a crash or execution of arbitrary code with the permissions of the user. Notable Changes: * Bug 1247990 - The root CA changes from NSS 3.23 have been backported. The full release notes are available at https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.22.2_release_notes The HG tag is NSS_3_22_2_RTM. NSS 3.22.2 requires NSPR 4.12 or newer. NSS 3.22.2 source distributions are available on ftp.mozilla.org for secure HTTPS download: https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_22_2_RTM/src/ The NSS development team would like to thank security researcher Francis Gabriel for responsibly disclosing the issue in Bug 1245528. -- dev-tech-crypto mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-crypto