[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 480-1] nss security update



Package        : nss
Version        : 3.14.5-1+deb7u6
CVE ID         : CVE-2015-7181 CVE-2015-7182 CVE-2016-1938 CVE-2016-1950 
                 CVE-2016-1978 CVE-2016-1979

This security update fixes serious security issues in NSS including
arbitrary code execution and remote denial service attacks.

For Debian 7 "wheezy", these problems have been fixed in
3.14.5-1+deb7u6. We recommend you upgrade your nss packages as soon as
possible.

CVE-2015-7181

    The sec_asn1d_parse_leaf function improperly restricts access to
    an unspecified data structure.

CVE-2015-7182

    Heap-based buffer overflow in the ASN.1 decoder.

CVE-2016-1938

    The s_mp_div function in lib/freebl/mpi/mpi.c in improperly
    divides numbers, which might make it easier for remote attackers
    to defeat cryptographic protection mechanisms.

CVE-2016-1950

    Heap-based buffer overflow allows remote attackers to execute
    arbitrary code via crafted ASN.1 data in an X.509 certificate.

CVE-2016-1978

    Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange
    function allows remote attackers to cause a denial of service or
    possibly have unspecified other impact by making an SSL (1) DHE or
    (2) ECDHE handshake at a time of high memory consumption.

CVE-2016-1979

    Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey
    function allows remote attackers to cause a denial of service or
    possibly have unspecified other impact via crafted key data with
    DER encoding.

Further information about Debian LTS security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

Attachment: signature.asc
Description: Digital signature


Reply to: