Your message dated Tue, 08 Nov 2011 20:09:12 +0000
with message-id <e1rnryq-0002fv...@franck.debian.org>
and subject line Bug#647614: fixed in nss 3.12.3.1-0lenny7
has caused the Debian Bug report #647614,
regarding CVE-2011-3640
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
647614: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=647614
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: nss
Severity: normal
Tags: security
Hi,
the following bug has been reported for NSS:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3640
While this doesn't warrant a DSA on it's own, we could fix it
along with the next NSS DSA (probably for the CA compromise
of the day?:
http://blog.mozilla.com/security/2011/11/03/revoking-trust-in-digicert-sdn-bhd-intermediate-certificate-authority/
)
Cheers,
Moritz
--- End Message ---
--- Begin Message ---
Source: nss
Source-Version: 3.12.3.1-0lenny7
We believe that the bug you reported is fixed in the latest version of
nss, which is due to be installed in the Debian FTP archive:
libnss3-1d-dbg_3.12.3.1-0lenny7_amd64.deb
to main/n/nss/libnss3-1d-dbg_3.12.3.1-0lenny7_amd64.deb
libnss3-1d_3.12.3.1-0lenny7_amd64.deb
to main/n/nss/libnss3-1d_3.12.3.1-0lenny7_amd64.deb
libnss3-dev_3.12.3.1-0lenny7_amd64.deb
to main/n/nss/libnss3-dev_3.12.3.1-0lenny7_amd64.deb
libnss3-tools_3.12.3.1-0lenny7_amd64.deb
to main/n/nss/libnss3-tools_3.12.3.1-0lenny7_amd64.deb
nss_3.12.3.1-0lenny7.diff.gz
to main/n/nss/nss_3.12.3.1-0lenny7.diff.gz
nss_3.12.3.1-0lenny7.dsc
to main/n/nss/nss_3.12.3.1-0lenny7.dsc
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 647...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mike Hommey <gland...@debian.org> (supplier of updated nss package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Sun, 06 Nov 2011 09:11:10 +0100
Source: nss
Binary: libnss3-1d libnss3-tools libnss3-dev libnss3-1d-dbg
Architecture: source amd64
Version: 3.12.3.1-0lenny7
Distribution: oldstable-security
Urgency: low
Maintainer: Maintainers of Mozilla-related packages
<pkg-mozilla-maintain...@lists.alioth.debian.org>
Changed-By: Mike Hommey <gland...@debian.org>
Description:
libnss3-1d - Network Security Service libraries
libnss3-1d-dbg - Debugging symbols for the Network Security Service libraries
libnss3-dev - Development files for the Network Security Service libraries
libnss3-tools - Network Security Service tools
Closes: 647614
Changes:
nss (3.12.3.1-0lenny7) oldstable-security; urgency=low
.
* Explicitly distrust malaysian Digicert Sdn. Bhd CA certificate.
* Address CVE-2011-3640 (Untrusted search path vulnerability).
Closes: #647614.
Checksums-Sha1:
fa850a16a41b69dd3303aa9d46172bd638a7bc31 2037 nss_3.12.3.1-0lenny7.dsc
abfbb245b79acbbce4fda5fb1dbe1380f3c54bb9 124008 nss_3.12.3.1-0lenny7.diff.gz
ec95207840e4ccb117edbb29ed898e9a6701cf46 1089414
libnss3-1d_3.12.3.1-0lenny7_amd64.deb
ab9a12ff1940199cb32c6b5cdf1b72ae3688e4eb 322160
libnss3-tools_3.12.3.1-0lenny7_amd64.deb
8bb0828da7e6d55317991164dcdb7970668c2953 262566
libnss3-dev_3.12.3.1-0lenny7_amd64.deb
4ea21f39b06d8a45fda90aa858d5b9fd90ff53b5 3108584
libnss3-1d-dbg_3.12.3.1-0lenny7_amd64.deb
Checksums-Sha256:
5933211cbbce4bfdf26d6aaab5e86ee6679232f95cf9c066db614ac56ddfa12d 2037
nss_3.12.3.1-0lenny7.dsc
c7e16fbade987f2edd6762545e351f2621095bddd35036f2a60e3df15655243c 124008
nss_3.12.3.1-0lenny7.diff.gz
994566b11b6457692e1306f8d8d6d8602932efe3dd860302005cb340a754a68e 1089414
libnss3-1d_3.12.3.1-0lenny7_amd64.deb
34b7bb8f7113accee3e0506c6d570a731714fa36652ff550df42ba67270a11e0 322160
libnss3-tools_3.12.3.1-0lenny7_amd64.deb
a0a43cc75cec3abf64450fa5898a94206efed6590dcba40bd09bdb3bac1c9622 262566
libnss3-dev_3.12.3.1-0lenny7_amd64.deb
efff2755b5006450f64497f8818b47cf304dfe9bab0c6334d64ce005ae80913d 3108584
libnss3-1d-dbg_3.12.3.1-0lenny7_amd64.deb
Files:
ec4d7880d0bb654b34a451c9250aeaa8 2037 libs optional nss_3.12.3.1-0lenny7.dsc
8a5855324b6fb51528a79e59a481d1ea 124008 libs optional
nss_3.12.3.1-0lenny7.diff.gz
b8d16610c9a8deb08bf339f21e716903 1089414 libs optional
libnss3-1d_3.12.3.1-0lenny7_amd64.deb
a8a019764394de3f2463b3a42fd4db28 322160 admin optional
libnss3-tools_3.12.3.1-0lenny7_amd64.deb
929c58149377ece067afd20c588bb837 262566 libdevel optional
libnss3-dev_3.12.3.1-0lenny7_amd64.deb
bc59d950c4944b7638b20c00398bb3be 3108584 debug extra
libnss3-1d-dbg_3.12.3.1-0lenny7_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iQIVAwUBTrZFS+QqoE+mqoxyAQgmcBAAjpkl5buw/A5/EaOl7aGX82WNG56ppKbi
3Qaq1290yx1uvLG0mkVE+18g4+Z3kuoD4Su4SeUCTl4FtzNG/CSV9yksQEwg9cAN
NqpsRaLx0h/HTW/m8ksCqm+ptCvH5iEciDFntyztgNYM1Yq6kYvLr9SfYqB+DV9d
xQzqIbMchQZ8M8PMsjB5/kUn15xZRAL3iW2mrm36Yxr6wdaxzpM+M9BJXqP1i8tY
gFsGm1Zow+JMXFndpFxkTFdQbYAfT2WnHvKTG85Ykw2RzTF0S2ggKyEyX8yf116M
mPRacf81gTgsLRLFb0tPh5/uYBqb9Fz58xwX1XJMngyeiz2U0Ne/IQfTt2waq2pz
e2EPweSqwWmXYlbXtuXWa4gOmEjNL3evPwccztRNDBFIpNi25odDAZVZYaUt5dji
AtdRozlxd8JW3o+dTG9ucwKFA4A5hKFRf9hxwM3XFwZtAMhr5Jo/kB2EH6GQkDQP
ztK+k9Zz/n+h9yATuStKkHWTy8qSZ7I+hRyl+YfOH6knjWGQHP8siG2qebjnCZ7g
IiPgScC1CWQGnOEQjq220uSNaW2EnQ2mh0Ov4ri8OFEihezvYua4h4zF4iJEpzr+
NJVcrSKb8Z+IMwBRyQo8w2Z2Dp2eu3F3JefqiNQ2T6XfHPSFowi0tM9EoslheqxO
lQodJMlYTK0=
=xSA9
-----END PGP SIGNATURE-----
--- End Message ---
