| Description: | Network Security Services (NSS) is a set of libraries designed to supportthe cross-platform development of security-enabled client and serverapplications. Netscape Portable Runtime (NSPR) provides platformindependence for non-GUI operating system facilities.It was found that a Certificate Authority (CA) mis-issued two intermediatecertificates to customers. These certificates could be used to launchman-in-the-middle attacks. This update renders those certificates asuntrusted. This covers all uses of the certificates, including SSL, S/MIME,and code signing. (BZ#890605)Note: This fix only applies to applications using the NSS Builtin ObjectToken. It does not render the certificates untrusted for applications thatuse the NSS library, but do not use the NSS Builtin Object Token.In addition, the nss package has been upgraded to upstream version 3.13.6,the nss-util package has been upgraded to upstream version 3.13.6, and thenspr package has been upgraded to upstream version 4.9.2. These updatesprovide a number of bug fixes and enhancements over the previous versions.(BZ#891663, BZ#891670, BZ#891661)Users of NSS, NSPR, and nss-util are advised to upgrade to these updatedpackages, which fix these issues and add these enhancements. Afterinstalling this update, applications using NSS, NSPR, or nss-util must berestarted for this update to take effect. |