Ubuntu 15.10: 2866-1 Critical: Firefox Network Data Exposure

ubuntu

January 8, 2016

Firefox could be made to expose sensitive information over the network.

Summary

Firefox could be made to expose sensitive information over the network.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly

allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were

able to perform a man-in-the-middle attack, this flaw could be exploited to

view sensitive information.

Topics Covered

security advisory critical Ubuntu firefox data exposure network issue

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  firefox                         43.0.4+build3-0ubuntu0.15.10.1

Ubuntu 15.04:
  firefox                         43.0.4+build3-0ubuntu0.15.04.1

Ubuntu 14.04 LTS:
  firefox                         43.0.4+build3-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  firefox                         43.0.4+build3-0ubuntu0.12.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.