id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
15802	nss-3.73	ken@…	ken@…	"new version to address a security vulnerability rated as critical.

[https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/]

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS #7, or PKCS #12 are likely to be impacted. Applications using NSS for certificate validation or other TLS, X.509, OCSP or CRL functionality may be impacted, depending on how they configure NSS.
Note: ''This vulnerability does NOT impact Mozilla Firefox.'' However, email clients and PDF viewers that use NSS for signature verification, such as Thunderbird, LibreOffice, Evolution and Evince are believed to be impacted.

from the oss-security list:
""Thunderbird 91.3.0 had shipped a workaround, that should protect against the
most risky attack vector (executing the vulnerable code path when importing
certificates contained in a received S/MIME message).""

I note that we are still on thunderbird-91.2.1 - a release candidate for thunderbird-91.4.0 was created on Monday, I assume that updating system nss will solve the problem for 91.2.1."	enhancement	closed	elevated	11.1	BOOK	git	medium	fixed