Version in base suite: 3.110-1+deb13u3

Base version: nss_3.110-1+deb13u3
Target version: nss_3.110-1+deb13u4
Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/nss/nss_3.110-1+deb13u3.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/n/nss/nss_3.110-1+deb13u4.dsc

 changelog                    |    7 ++++
 patches/CVE-2026-16389.patch |   64 +++++++++++++++++++++++++++++++++++++++++++
 patches/series               |    1 
 3 files changed, 72 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp1_xj_usy/nss_3.110-1+deb13u3.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp1_xj_usy/nss_3.110-1+deb13u4.dsc: no acceptable signature found
diff -Nru nss-3.110/debian/changelog nss-3.110/debian/changelog
--- nss-3.110/debian/changelog	2026-06-30 18:22:51.000000000 +0000
+++ nss-3.110/debian/changelog	2026-07-28 18:49:37.000000000 +0000
@@ -1,3 +1,10 @@
+nss (2:3.110-1+deb13u4) trixie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * guard against integer overflow in CERT_Hexify (CVE-2026-16389)
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Tue, 28 Jul 2026 20:49:37 +0200
+
 nss (2:3.110-1+deb13u3) trixie; urgency=medium
 
   * Non-maintainer upload.
diff -Nru nss-3.110/debian/patches/CVE-2026-16389.patch nss-3.110/debian/patches/CVE-2026-16389.patch
--- nss-3.110/debian/patches/CVE-2026-16389.patch	1970-01-01 00:00:00.000000000 +0000
+++ nss-3.110/debian/patches/CVE-2026-16389.patch	2026-07-28 18:48:42.000000000 +0000
@@ -0,0 +1,64 @@
+
+# HG changeset patch
+# User John Schanck <jschanck@mozilla.com>
+# Date 1780340220 0
+# Node ID 9e854d9c6234ac0990f9002b364abddb6a6a645d
+# Parent  ac269fd365ad336aa616fe5a35011ba94ebac905
+Bug 2043887 - guard against integer overflow in CERT_Hexify. r=nss-reviewers,keeler
+
+Differential Revision: https://phabricator.services.mozilla.com/D303808
+
+diff --git a/nss/lib/certhigh/certhtml.c b/nss/lib/certhigh/certhtml.c
+--- a/nss/lib/certhigh/certhtml.c
++++ b/nss/lib/certhigh/certhtml.c
+@@ -1,24 +1,27 @@
+ /* This Source Code Form is subject to the terms of the Mozilla Public
+  * License, v. 2.0. If a copy of the MPL was not distributed with this
+  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+ 
+ /*
+  * certhtml.c --- convert a cert to html
+  */
+ 
++#include <limits.h>
++
+ #include "seccomon.h"
+ #include "secitem.h"
+ #include "sechash.h"
+ #include "cert.h"
+ #include "keyhi.h"
+ #include "secder.h"
+ #include "prprf.h"
+ #include "secport.h"
++#include "secerr.h"
+ #include "secasn1.h"
+ #include "pk11func.h"
+ 
+ static char *hex = "0123456789ABCDEF";
+ 
+ /*
+ ** Convert a der-encoded integer to a hex printable string form
+ */
+@@ -27,16 +30,21 @@ CERT_Hexify(SECItem *i, int do_colon)
+ {
+     unsigned char *cp, *end;
+     char *rv, *o;
+ 
+     if (!i->len) {
+         return PORT_Strdup("00");
+     }
+ 
++    if (i->len > UINT_MAX / 3) {
++        PORT_SetError(SEC_ERROR_INVALID_ARGS);
++        return NULL;
++    }
++
+     rv = o = (char *)PORT_Alloc(i->len * 3);
+     if (!rv)
+         return rv;
+ 
+     cp = i->data;
+     end = cp + i->len;
+     while (cp < end) {
+         unsigned char ch = *cp++;
+
diff -Nru nss-3.110/debian/patches/series nss-3.110/debian/patches/series
--- nss-3.110/debian/patches/series	2026-06-30 18:21:02.000000000 +0000
+++ nss-3.110/debian/patches/series	2026-07-28 18:47:10.000000000 +0000
@@ -5,3 +5,4 @@
 CVE-2026-6767.patch
 CVE-2026-6772.patch
 CVE-2026-12318.patch
+CVE-2026-16389.patch