Bugzilla – Bug 963731
VUL-0: CVE-2016-1938: mozilla-nss: Calculations with mp_div and mp_exptmod in Network Security Services (NSS) canproduce wrong results
Last modified: 2020-04-05 18:20:35 UTC
https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/ Security researcher Hanno Böck reported that calculations with mp_div and mp_exptmod in Network Security Services (NSS) can produce wrong results in some circumstances. These functions are used within NSS for a variety of cryptographic division functions, leading to potential cryptographic weaknesses. https://bugzilla.mozilla.org/show_bug.cgi?id=1190248 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1938 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1938.html
Does this issue affect mozilla-nss 3.19.2.2 in SLE? The openSUSE MozillaFirefox 44.0 submission sais: > * MFSA 2016-07/CVE-2016-1938 (bmo#1190248) > Errors in mp_div and mp_exptmod cryptographic functions in NSS > (fixed by requiring NSS 3.21) Does that mean that only non-ESR MozillaFirefox is affected (and thus only openSUSE)? If it affects ESR, does the fix go into mozilla-nss, MozillaFirefox ESR or both?
According to bmo it is fixed in mozilla-nss. (Firefox source code has NSS integrated but not built for us.) Fix is in 3.21 currently and a comment says that they intend to fix it in Firefox 38.7.0 for ESR. This might mean that the fix will be backported to an older NSS branch or Firefox ESR will get a new dependency to 3.21. This means for this very moment that 38.6.0 with mozilla-nss < 3.21 is affected and upstream will only address it with next release.
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2016-02-10. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/62468
bugbot adjusting priority
openSUSE-SU-2016:0309-1: An update that fixes 14 vulnerabilities is now available. Category: security (important) Bug References: 963633,963634,963635,963637,963641,963643,963644,963645,963731 CVE References: CVE-2015-7208,CVE-2016-1930,CVE-2016-1931,CVE-2016-1933,CVE-2016-1935,CVE-2016-1937,CVE-2016-1938,CVE-2016-1939,CVE-2016-1942,CVE-2016-1943,CVE-2016-1944,CVE-2016-1945,CVE-2016-1946,CVE-2016-1947 Sources used: openSUSE Leap 42.1 (src): MozillaFirefox-44.0-12.2, mozilla-nspr-4.11-7.1, mozilla-nss-3.21-9.1 openSUSE 13.2 (src): MozillaFirefox-44.0-59.1, mozilla-nspr-4.11-12.1, mozilla-nss-3.21-25.1
SUSE-SU-2016:0334-1: An update that solves three vulnerabilities and has two fixes is now available. Category: security (important) Bug References: 954447,963520,963632,963635,963731 CVE References: CVE-2016-1930,CVE-2016-1935,CVE-2016-1938 Sources used: SUSE Linux Enterprise Software Development Kit 11-SP4 (src): MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2 SUSE Linux Enterprise Software Development Kit 11-SP3 (src): MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2 SUSE Linux Enterprise Server for VMWare 11-SP3 (src): MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2 SUSE Linux Enterprise Server 11-SP4 (src): MozillaFirefox-38.6.0esr-31.3, MozillaFirefox-branding-SLED-38-18.24, mozilla-nss-3.20.2-25.2 SUSE Linux Enterprise Server 11-SP3 (src): MozillaFirefox-38.6.0esr-31.3, MozillaFirefox-branding-SLED-38-18.24, mozilla-nss-3.20.2-25.2 SUSE Linux Enterprise Desktop 11-SP4 (src): MozillaFirefox-38.6.0esr-31.3, MozillaFirefox-branding-SLED-38-18.24, mozilla-nss-3.20.2-25.2 SUSE Linux Enterprise Desktop 11-SP3 (src): MozillaFirefox-38.6.0esr-31.3, MozillaFirefox-branding-SLED-38-18.24, mozilla-nss-3.20.2-25.2 SUSE Linux Enterprise Debuginfo 11-SP4 (src): MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2 SUSE Linux Enterprise Debuginfo 11-SP3 (src): MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2
SUSE-SU-2016:0338-1: An update that solves three vulnerabilities and has three fixes is now available. Category: security (important) Bug References: 954447,963520,963632,963635,963731,964332 CVE References: CVE-2016-1930,CVE-2016-1935,CVE-2016-1938 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP1 (src): MozillaFirefox-38.6.0esr-57.3, mozilla-nss-3.20.2-37.1 SUSE Linux Enterprise Software Development Kit 12 (src): MozillaFirefox-38.6.0esr-57.3, mozilla-nss-3.20.2-37.1 SUSE Linux Enterprise Server 12-SP1 (src): MozillaFirefox-38.6.0esr-57.3, MozillaFirefox-branding-SLE-31.0-20.1, mozilla-nss-3.20.2-37.1 SUSE Linux Enterprise Server 12 (src): MozillaFirefox-38.6.0esr-57.3, MozillaFirefox-branding-SLE-31.0-20.1, mozilla-nss-3.20.2-37.1 SUSE Linux Enterprise Desktop 12-SP1 (src): MozillaFirefox-38.6.0esr-57.3, MozillaFirefox-branding-SLE-31.0-20.1, mozilla-nss-3.20.2-37.1 SUSE Linux Enterprise Desktop 12 (src): MozillaFirefox-38.6.0esr-57.3, MozillaFirefox-branding-SLE-31.0-20.1, mozilla-nss-3.20.2-37.1
SUSE-SU-2016:0584-1: An update that solves 5 vulnerabilities and has two fixes is now available. Category: security (moderate) Bug References: 954447,959888,963520,963632,963635,963731,967087 CVE References: CVE-2015-7575,CVE-2016-1523,CVE-2016-1930,CVE-2016-1935,CVE-2016-1938 Sources used: SUSE Linux Enterprise Server 11-SP2-LTSS (src): MozillaFirefox-38.6.1esr-33.1, MozillaFirefox-branding-SLED-38-15.58, mozilla-nss-3.20.2-17.5 SUSE Linux Enterprise Debuginfo 11-SP2 (src): MozillaFirefox-38.6.1esr-33.1, mozilla-nss-3.20.2-17.5
released