Vulnerability in nspr package - security update
Summary
DLA-676-1: nspr - security update. Affects nspr versions < 2:4.12-1+deb7u1. Fixed in 2:4.12-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nspr package is a part of the NetScape Portable Runtime Library (NSPR) and is used by the Network Security Service (NSS) libraries. NSPR provides a platform-independent API for system-level and libc-like functions. It is widely used in various applications and services to handle low-level operations such as file I/O, memory management, and threading. However, the nspr package in Debian 7 Wheezy is vulnerable to a security issue that can impact the operation of NSS and compromise the security of the system.
Vulnerability Detail
The vulnerability in the nspr package arises from the usage of environment variables to configure various aspects of the NSS libraries. These environment variables can refer to file system locations and can potentially be manipulated to force compatibility modes or cause other operational issues. The previous versions of NSPR did not ignore these environment variables in SUID binaries, which could lead to unintended behavior and security risks. To address this, NSPR version 4.12-1+deb7u1 introduces a new API, PR_GetEnVSecure, which ensures that environment variables are properly handled and secure. Upgrading both NSPR and NSS to the fixed versions is necessary to mitigate this vulnerability.
How To Fix
Minimum fixed version
2:4.12-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nsprTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The nspr package in Debian 7 Wheezy is vulnerable to a security issue related to the handling of environment variables. Upgrading the nspr package to version 4.12-1+deb7u1 is recommended to address this vulnerability. It is important to promptly apply security updates to ensure the security and stability of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nspr →
FAQ
The vulnerability can potentially allow an attacker to manipulate environment variables and force compatibility modes or cause other operational issues in NSS. This can compromise the security and stability of the system.
Yes, this vulnerability is specific to the nspr package in Debian 7 Wheezy. Other distributions or versions may have different vulnerabilities or may not be affected.
At the time of this advisory, there are no known exploits for this vulnerability. However, it is always recommended to apply security updates promptly to mitigate any potential risks.
No, this vulnerability requires local access to the system in order to manipulate the environment variables and exploit the issue.
Yes, you can find further information about this vulnerability, how to apply updates, and frequently asked questions in the Debian LTS security advisory: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for nspr.
