Ubuntu 15.10: 2864-1 Critical: NSS Network Attack Risk of Data Exposure

ubuntu

January 7, 2016

NSS could be made to expose sensitive information over the network.

Summary

NSS could be made to expose sensitive information over the network.

Software Description:

- nss: Network Security Service library

Details:

Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly

allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were

able to perform a man-in-the-middle attack, this flaw could be exploited to

view sensitive information.

Topics Covered

security advisory critical ubuntu network attack data exposure nss

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  libnss3                         2:3.19.2.1-0ubuntu0.15.10.2

Ubuntu 15.04:
  libnss3                         2:3.19.2.1-0ubuntu0.15.04.2

Ubuntu 14.04 LTS:
  libnss3                         2:3.19.2.1-0ubuntu0.14.04.2

Ubuntu 12.04 LTS:
  libnss3                         3.19.2.1-0ubuntu0.12.04.2

After a standard system update you need to restart any applications that
use NSS, such as Evolution and Chromium, to make all the necessary changes.