Henry Corrigan-Gibbs discovered that NSS incorrectly handled importing certain curve25519 private keys. An attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2019-11719)
Hubert Kario discovered that NSS incorrectly handled PKCS#1 v1.5 signatures when using TLSv1.3. An attacker could possibly use this issue to trick NSS into using PKCS#1 v1.5 signatures, contrary to expectations. This issue only applied to Ubuntu 19.04. (CVE-2019-11727)
Jonas Allmann discovered that NSS incorrectly handled certain p256-ECDH public keys. An attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service. (CVE-2019-11729)
{ "availability": "No subscription required", "binaries": [ { "libnss3-nssdb": "2:3.28.4-0ubuntu0.16.04.6", "libnss3-1d": "2:3.28.4-0ubuntu0.16.04.6", "libnss3-dbgsym": "2:3.28.4-0ubuntu0.16.04.6", "libnss3": "2:3.28.4-0ubuntu0.16.04.6", "libnss3-dev": "2:3.28.4-0ubuntu0.16.04.6", "libnss3-dbg": "2:3.28.4-0ubuntu0.16.04.6", "libnss3-tools": "2:3.28.4-0ubuntu0.16.04.6", "libnss3-tools-dbgsym": "2:3.28.4-0ubuntu0.16.04.6" } ] }