Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 538
Alerts This Week
Warning Icon 1 538

Ubuntu 16.04 ESM USN-5168-3 Moderate: NSS Denial Of Service

ubuntu
Calendar Grey December 1, 2021
Dist Ubuntu Esm H88
The Ubuntu Security Notice USN-5168-3 outlines a vulnerability in NSS that may result in application crashes or enable unauthorized program execution.
NSS could be made to crash or run programs if it verified a specially crafted signature.

Summary

NSS could be made to crash or run programs if it verified a specially

crafted signature.

Software Description:

- nss: Network Security Service library

Details:

USN-5168-1 fixed a vulnerability in NSS. This update provides

the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

Tavis Ormandy discovered that NSS incorrectly handled verifying DSA/RSA-PSS

signatures. A remote attacker could use this issue to cause NSS to crash,

resulting in a denial of service, or possibly execute arbitrary code.

Topics%20covered

Topics Covered

security advisory moderate denial of service ubuntu nss

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
  libnss3                         2:3.28.4-0ubuntu0.16.04.14+esm1

Ubuntu 14.04 ESM:
  libnss3                         2:3.28.4-0ubuntu0.14.04.5+esm9

After a standard system update you need to restart any applications that
use NSS, such as Evolution, to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5168-3

https://ubuntu.com/security/notices/USN-5168-1

CVE-2021-43527

December 01, 2021

Topics%20covered

Topics Covered

security advisory moderate denial of service ubuntu nss

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.