Debian: DSA-3688-1: nss security update

    Date05 Oct 2016
    CategoryDebian
    97
    Posted ByLinuxSecurity Advisories
    Several vulnerabilities were discovered in NSS, the cryptography library developed by the Mozilla project. CVE-2015-4000
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-3688-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                           Florian Weimer
    October 05, 2016                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------
    
    Package        : nss
    CVE ID         : CVE-2015-4000 CVE-2015-7181 CVE-2015-7182 CVE-2015-7575 
                     CVE-2016-1938 CVE-2016-1950 CVE-2016-1978 CVE-2016-1979
    		 CVE-2016-2834
    Debian Bug     : 583651
    
    Several vulnerabilities were discovered in NSS, the cryptography
    library developed by the Mozilla project.
    
    CVE-2015-4000
    
        David Adrian et al. reported that it may be feasible to attack
        Diffie-Hellman-based cipher suites in certain circumstances,
        compromising the confidentiality and integrity of data encrypted
        with Transport Layer Security (TLS).
    
    CVE-2015-7181
    CVE-2015-7182
    CVE-2016-1950
    
        Tyson Smith, David Keeler, and Francis Gabriel discovered
        heap-based buffer overflows in the ASN.1 DER parser, potentially
        leading to arbitrary code execution.
    
    CVE-2015-7575
    
        Karthikeyan Bhargavan discovered that TLS client implementation
        accepted MD5-based signatures for TLS 1.2 connections with forward
        secrecy, weakening the intended security strength of TLS
        connections.
    
    CVE-2016-1938
    
        Hanno Boeck discovered that NSS miscomputed the result of integer
        division for certain inputs.  This could weaken the cryptographic
        protections provided by NSS.  However, NSS implements RSA-CRT leak
        hardening, so RSA private keys are not directly disclosed by this
        issue.
    
    CVE-2016-1978
    
        Eric Rescorla discovered a user-after-free vulnerability in the
        implementation of ECDH-based TLS handshakes, with unknown
        consequences.
    
    CVE-2016-1979
    
        Tim Taubert discovered a use-after-free vulnerability in ASN.1 DER
        processing, with application-specific impact.
    
    CVE-2016-2834
    
        Tyson Smith and Jed Davis discovered unspecified memory-safety
        bugs in NSS.
    
    In addition, the NSS library did not ignore environment variables in
    processes which underwent a SUID/SGID/AT_SECURE transition at process
    start.  In certain system configurations, this allowed local users to
    escalate their privileges.
    
    This update contains further correctness and stability fixes without
    immediate security impact.
    
    For the stable distribution (jessie), these problems have been fixed in
    version 2:3.26-1+debu8u1.
    
    For the unstable distribution (sid), these problems have been fixed in
    version 2:3.23-1.
    
    We recommend that you upgrade your nss packages.
    
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/
    
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"22","type":"x","order":"1","pct":55,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":12.5,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"13","type":"x","order":"3","pct":32.5,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.