Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu 14.04 LTS: USN-1550-1 Critical: NTP Vulnerability Patch

ubuntu
Calendar Grey August 21, 2012
Scroller Ubuntu
Update for Ubuntu 12.04 LTS to fix NSS crash from crafted certificates. Immediate action recommended!
NSS could be made to crash if it opened a specially crafted certificate.

Summary

NSS could be made to crash if it opened a specially crafted certificate.

Software Description:

- nss: Network Security Service library

Details:

USN-1540-1 fixed vulnerabilities in NSS. This update provides the

corresponding updates for Ubuntu 12.04 LTS.

Original advisory details:

Kaspar Brand discovered a vulnerability in how the Network Security

Services (NSS) ASN.1 decoder handles zero length items. If the user were

tricked into opening a specially crafted certificate, an attacker could

possibly exploit this to cause a denial of service via application crash.

Topics%20covered

Topics Covered

security advisory denial of service high severity ubuntu nss

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libnss3                         3.13.1.with.ckbi.1.88-1ubuntu6.1

After a standard system update you need to restart any applications that
use NSS, such as Evolution, to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1540-2

https://ubuntu.com/security/notices/USN-1540-1

CVE-2012-0441

Severity
critical
Lowest
Low
Medium
High
Critical

August 21, 2012

Topics%20covered

Topics Covered

security advisory denial of service high severity ubuntu nss

Package Information

https://launchpad.net/ubuntu/+source/nss/3.13.1.with.ckbi.1.88-1ubuntu6.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.