[USN-3029-1] NSS vulnerability
Severity
Medium
Affected Packages
10
CVEs
1
NSS could be made to crash or run programs if it processed specially crafted network traffic.
Tyson Smith and Jed Davis discovered that NSS incorrectly handled memory. A
remote attacker could use this issue to cause NSS to crash, resulting in a
denial of service, or possibly execute arbitrary code.
This update refreshes the NSS package to version 3.23 which includes
the latest CA certificate bundle. As a security improvement, this update
also modifies NSS behaviour to reject DH key sizes below 1024 bits,
preventing a possible downgrade attack.
Package | Affected Version |
---|---|
pkg:deb/ubuntu/libnss3?distro=xenial | < 3.23-0ubuntu0.16.04.1 |
pkg:deb/ubuntu/libnss3?distro=trusty | < 3.23-0ubuntu0.14.04.1 |
pkg:deb/ubuntu/libnss3-tools?distro=xenial | < 3.23-0ubuntu0.16.04.1 |
pkg:deb/ubuntu/libnss3-tools?distro=trusty | < 3.23-0ubuntu0.14.04.1 |
pkg:deb/ubuntu/libnss3-nssdb?distro=xenial | < 3.23-0ubuntu0.16.04.1 |
pkg:deb/ubuntu/libnss3-nssdb?distro=trusty | < 3.23-0ubuntu0.14.04.1 |
pkg:deb/ubuntu/libnss3-dev?distro=xenial | < 3.23-0ubuntu0.16.04.1 |
pkg:deb/ubuntu/libnss3-dev?distro=trusty | < 3.23-0ubuntu0.14.04.1 |
pkg:deb/ubuntu/libnss3-1d?distro=xenial | < 3.23-0ubuntu0.16.04.1 |
pkg:deb/ubuntu/libnss3-1d?distro=trusty | < 3.23-0ubuntu0.14.04.1 |
- ID
- USN-3029-1
- Severity
- medium
- URL
- https://ubuntu.com/security/notices/USN-3029-1
- Published
-
2016-07-11T16:36:57
(8 years ago) - Modified
-
2016-07-11T16:36:57
(8 years ago) - Other Advisories
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:deb/ubuntu/libnss3?distro=xenial | ubuntu | libnss3 | < 3.23-0ubuntu0.16.04.1 | xenial | ||
Affected | pkg:deb/ubuntu/libnss3?distro=trusty | ubuntu | libnss3 | < 3.23-0ubuntu0.14.04.1 | trusty | ||
Affected | pkg:deb/ubuntu/libnss3-tools?distro=xenial | ubuntu | libnss3-tools | < 3.23-0ubuntu0.16.04.1 | xenial | ||
Affected | pkg:deb/ubuntu/libnss3-tools?distro=trusty | ubuntu | libnss3-tools | < 3.23-0ubuntu0.14.04.1 | trusty | ||
Affected | pkg:deb/ubuntu/libnss3-nssdb?distro=xenial | ubuntu | libnss3-nssdb | < 3.23-0ubuntu0.16.04.1 | xenial | ||
Affected | pkg:deb/ubuntu/libnss3-nssdb?distro=trusty | ubuntu | libnss3-nssdb | < 3.23-0ubuntu0.14.04.1 | trusty | ||
Affected | pkg:deb/ubuntu/libnss3-dev?distro=xenial | ubuntu | libnss3-dev | < 3.23-0ubuntu0.16.04.1 | xenial | ||
Affected | pkg:deb/ubuntu/libnss3-dev?distro=trusty | ubuntu | libnss3-dev | < 3.23-0ubuntu0.14.04.1 | trusty | ||
Affected | pkg:deb/ubuntu/libnss3-1d?distro=xenial | ubuntu | libnss3-1d | < 3.23-0ubuntu0.16.04.1 | xenial | ||
Affected | pkg:deb/ubuntu/libnss3-1d?distro=trusty | ubuntu | libnss3-1d | < 3.23-0ubuntu0.14.04.1 | trusty |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |