Linux Security
Linux Security
Linux Security

Debian: DSA-3688-1: nss security update

Date 05 Oct 2016
199
Posted By LinuxSecurity Advisories
Several vulnerabilities were discovered in NSS, the cryptography library developed by the Mozilla project. CVE-2015-4000
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3688-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.
https://www.debian.org/security/                           Florian Weimer
October 05, 2016                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : nss
CVE ID         : CVE-2015-4000 CVE-2015-7181 CVE-2015-7182 CVE-2015-7575 
                 CVE-2016-1938 CVE-2016-1950 CVE-2016-1978 CVE-2016-1979
		 CVE-2016-2834
Debian Bug     : 583651

Several vulnerabilities were discovered in NSS, the cryptography
library developed by the Mozilla project.

CVE-2015-4000

    David Adrian et al. reported that it may be feasible to attack
    Diffie-Hellman-based cipher suites in certain circumstances,
    compromising the confidentiality and integrity of data encrypted
    with Transport Layer Security (TLS).

CVE-2015-7181
CVE-2015-7182
CVE-2016-1950

    Tyson Smith, David Keeler, and Francis Gabriel discovered
    heap-based buffer overflows in the ASN.1 DER parser, potentially
    leading to arbitrary code execution.

CVE-2015-7575

    Karthikeyan Bhargavan discovered that TLS client implementation
    accepted MD5-based signatures for TLS 1.2 connections with forward
    secrecy, weakening the intended security strength of TLS
    connections.

CVE-2016-1938

    Hanno Boeck discovered that NSS miscomputed the result of integer
    division for certain inputs.  This could weaken the cryptographic
    protections provided by NSS.  However, NSS implements RSA-CRT leak
    hardening, so RSA private keys are not directly disclosed by this
    issue.

CVE-2016-1978

    Eric Rescorla discovered a user-after-free vulnerability in the
    implementation of ECDH-based TLS handshakes, with unknown
    consequences.

CVE-2016-1979

    Tim Taubert discovered a use-after-free vulnerability in ASN.1 DER
    processing, with application-specific impact.

CVE-2016-2834

    Tyson Smith and Jed Davis discovered unspecified memory-safety
    bugs in NSS.

In addition, the NSS library did not ignore environment variables in
processes which underwent a SUID/SGID/AT_SECURE transition at process
start.  In certain system configurations, this allowed local users to
escalate their privileges.

This update contains further correctness and stability fixes without
immediate security impact.

For the stable distribution (jessie), these problems have been fixed in
version 2:3.26-1+debu8u1.

For the unstable distribution (sid), these problems have been fixed in
version 2:3.23-1.

We recommend that you upgrade your nss packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.

LinuxSecurity Poll

How frequently do you patch/update your system?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum 0 answer(s) and maximum 3 answer(s).
/main-polls/52-how-frequently-do-you-patch-update-your-system?task=poll.vote&format=json
52
radio
[{"id":"179","title":"As soon as patches\/updates are released - I track advisories for my distro(s) diligently","votes":"42","type":"x","order":"1","pct":84,"resources":[]},{"id":"180","title":"Every so often, when I think of it","votes":"4","type":"x","order":"2","pct":8,"resources":[]},{"id":"181","title":"Hardly ever","votes":"4","type":"x","order":"3","pct":8,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

Please vote first in order to view vote results.

VOTE ON THE POLL PAGE


VIEW MORE POLLS

bottom 200

Please enable / Bitte aktiviere JavaScript!
Veuillez activer / Por favor activa el Javascript![ ? ]

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.