Bug 963731 - (CVE-2016-1938) VUL-0: CVE-2016-1938: mozilla-nss: Calculations with mp_div and mp_exptmod in Network Security Services (NSS) canproduce wrong results
(CVE-2016-1938)
VUL-0: CVE-2016-1938: mozilla-nss: Calculations with mp_div and mp_exptmod in...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Petr Cerny
Security Team bot
https://smash.suse.de/issue/161342/
maint:running:62468:moderate CVSSv2:...
:
Depends on: 963520
Blocks:
  Show dependency treegraph
 
Reported: 2016-01-27 09:08 UTC by Andreas Stieger
Modified: 2020-04-05 18:20 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2016-01-27 09:08:03 UTC
https://www.mozilla.org/en-US/security/advisories/mfsa2016-07/

Security researcher Hanno Böck reported that calculations with mp_div and mp_exptmod in Network Security Services (NSS) can produce wrong results in some circumstances. These functions are used within NSS for a variety of cryptographic division functions, leading to potential cryptographic weaknesses. 

https://bugzilla.mozilla.org/show_bug.cgi?id=1190248

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1938
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-1938.html
Comment 1 Andreas Stieger 2016-01-27 09:17:19 UTC
Does this issue affect mozilla-nss 3.19.2.2 in SLE?

The openSUSE MozillaFirefox 44.0 submission sais:

>   * MFSA 2016-07/CVE-2016-1938 (bmo#1190248)
>     Errors in mp_div and mp_exptmod cryptographic functions in NSS
>     (fixed by requiring NSS 3.21)

Does that mean that only non-ESR MozillaFirefox is affected (and thus only openSUSE)?

If it affects ESR, does the fix go into mozilla-nss, MozillaFirefox ESR or both?
Comment 2 Wolfgang Rosenauer 2016-01-27 09:29:08 UTC
According to bmo it is fixed in mozilla-nss. (Firefox source code has NSS integrated but not built for us.)
Fix is in 3.21 currently and a comment says that they intend to fix it in Firefox 38.7.0 for ESR. This might mean that the fix will be backported to an older NSS branch or Firefox ESR will get a new dependency to 3.21.

This means for this very moment that 38.6.0 with mozilla-nss < 3.21 is affected and upstream will only address it with next release.
Comment 3 Swamp Workflow Management 2016-01-27 10:28:34 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-02-10.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62468
Comment 6 Swamp Workflow Management 2016-01-28 23:00:21 UTC
bugbot adjusting priority
Comment 8 Swamp Workflow Management 2016-02-02 01:14:14 UTC
openSUSE-SU-2016:0309-1: An update that fixes 14 vulnerabilities is now available.

Category: security (important)
Bug References: 963633,963634,963635,963637,963641,963643,963644,963645,963731
CVE References: CVE-2015-7208,CVE-2016-1930,CVE-2016-1931,CVE-2016-1933,CVE-2016-1935,CVE-2016-1937,CVE-2016-1938,CVE-2016-1939,CVE-2016-1942,CVE-2016-1943,CVE-2016-1944,CVE-2016-1945,CVE-2016-1946,CVE-2016-1947
Sources used:
openSUSE Leap 42.1 (src):    MozillaFirefox-44.0-12.2, mozilla-nspr-4.11-7.1, mozilla-nss-3.21-9.1
openSUSE 13.2 (src):    MozillaFirefox-44.0-59.1, mozilla-nspr-4.11-12.1, mozilla-nss-3.21-25.1
Comment 9 Swamp Workflow Management 2016-02-04 18:13:01 UTC
SUSE-SU-2016:0334-1: An update that solves three vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 954447,963520,963632,963635,963731
CVE References: CVE-2016-1930,CVE-2016-1935,CVE-2016-1938
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2
SUSE Linux Enterprise Software Development Kit 11-SP3 (src):    MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2
SUSE Linux Enterprise Server for VMWare 11-SP3 (src):    MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2
SUSE Linux Enterprise Server 11-SP4 (src):    MozillaFirefox-38.6.0esr-31.3, MozillaFirefox-branding-SLED-38-18.24, mozilla-nss-3.20.2-25.2
SUSE Linux Enterprise Server 11-SP3 (src):    MozillaFirefox-38.6.0esr-31.3, MozillaFirefox-branding-SLED-38-18.24, mozilla-nss-3.20.2-25.2
SUSE Linux Enterprise Desktop 11-SP4 (src):    MozillaFirefox-38.6.0esr-31.3, MozillaFirefox-branding-SLED-38-18.24, mozilla-nss-3.20.2-25.2
SUSE Linux Enterprise Desktop 11-SP3 (src):    MozillaFirefox-38.6.0esr-31.3, MozillaFirefox-branding-SLED-38-18.24, mozilla-nss-3.20.2-25.2
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    MozillaFirefox-38.6.0esr-31.3, mozilla-nss-3.20.2-25.2
Comment 10 Swamp Workflow Management 2016-02-04 18:17:00 UTC
SUSE-SU-2016:0338-1: An update that solves three vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 954447,963520,963632,963635,963731,964332
CVE References: CVE-2016-1930,CVE-2016-1935,CVE-2016-1938
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    MozillaFirefox-38.6.0esr-57.3, mozilla-nss-3.20.2-37.1
SUSE Linux Enterprise Software Development Kit 12 (src):    MozillaFirefox-38.6.0esr-57.3, mozilla-nss-3.20.2-37.1
SUSE Linux Enterprise Server 12-SP1 (src):    MozillaFirefox-38.6.0esr-57.3, MozillaFirefox-branding-SLE-31.0-20.1, mozilla-nss-3.20.2-37.1
SUSE Linux Enterprise Server 12 (src):    MozillaFirefox-38.6.0esr-57.3, MozillaFirefox-branding-SLE-31.0-20.1, mozilla-nss-3.20.2-37.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    MozillaFirefox-38.6.0esr-57.3, MozillaFirefox-branding-SLE-31.0-20.1, mozilla-nss-3.20.2-37.1
SUSE Linux Enterprise Desktop 12 (src):    MozillaFirefox-38.6.0esr-57.3, MozillaFirefox-branding-SLE-31.0-20.1, mozilla-nss-3.20.2-37.1
Comment 11 Swamp Workflow Management 2016-02-25 19:14:10 UTC
SUSE-SU-2016:0584-1: An update that solves 5 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 954447,959888,963520,963632,963635,963731,967087
CVE References: CVE-2015-7575,CVE-2016-1523,CVE-2016-1930,CVE-2016-1935,CVE-2016-1938
Sources used:
SUSE Linux Enterprise Server 11-SP2-LTSS (src):    MozillaFirefox-38.6.1esr-33.1, MozillaFirefox-branding-SLED-38-15.58, mozilla-nss-3.20.2-17.5
SUSE Linux Enterprise Debuginfo 11-SP2 (src):    MozillaFirefox-38.6.1esr-33.1, mozilla-nss-3.20.2-17.5
Comment 12 Marcus Meissner 2016-03-02 11:03:44 UTC
released