Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 492
Alerts This Week
Warning Icon 1 492

Ubuntu: USN-2897-1 Moderate: Nettle Carry Propagation Risks

ubuntu
Calendar Grey February 15, 2016
Scroller Ubuntu
Addressing multiple vulnerabilities in the nettle cryptographic library across Ubuntu distributions, ensuring users receive prompt updates for enhanced security.
Several security issues were fixed in Nettle.

Summary

Several security issues were fixed in Nettle.

Software Description:

- nettle: low level cryptographic library (public-key cryptos)

Details:

Hanno Böck discovered that Nettle incorrectly handled carry propagation in

the NIST P-256 elliptic curve. (CVE-2015-8803)

Hanno Böck discovered that Nettle incorrectly handled carry propagation in

the NIST P-384 elliptic curve. (CVE-2015-8804)

Niels Moeller discovered that Nettle incorrectly handled carry propagation

in the NIST P-256 elliptic curve. (CVE-2015-8805)

Topics%20covered

Topics Covered

security advisory ubuntu issue fix cryptographic library nettle carry propagation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 15.10:
  libnettle6                      3.1.1-4ubuntu0.1

Ubuntu 14.04 LTS:
  libnettle4                      2.7.1-1ubuntu0.1

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2897-1

CVE-2015-8803, CVE-2015-8804, CVE-2015-8805

Severity
important
Lowest
Low
Medium
High
Critical

February 15, 2016

Topics%20covered

Topics Covered

security advisory ubuntu issue fix cryptographic library nettle carry propagation

Package Information

https://launchpad.net/ubuntu/+source/nettle/3.1.1-4ubuntu0.1
https://launchpad.net/ubuntu/+source/nettle/2.7.1-1ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.