[SECURITY] [DLA 176-1] mono security update

2015-03-1912:41:15

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

87.0%

JSON

Package : mono
Version : 2.6.7-5.1+deb6u1
CVE ID : CVE-2015-2318 CVE-2015-2319 CVE-2015-2320
Debian Bug : 780751

Three issues with Mono's TLS stack are addressed.

CVE-2015-2318

Mono&#x27;s implementation of the SSL/TLS stack failed to check
the order of the handshake messages. Which would allow
various attacks on the protocol to succeed. (&quot;SKIP-TLS&quot;)

CVE-2015-2319

Mono&#x27;s implementation of SSL/TLS also contained support for
the weak EXPORT cyphers and was susceptible to the FREAK attack.

CVE-2015-2320

Mono contained SSLv2 fallback code, which is no longer needed
and can be considered insecure.

OSVersionArchitecturePackageVersionFilename
Debian6alllibmono-messaging-rabbitmq2.0-cil< 2.6.7-5.1+deb6u1libmono-messaging-rabbitmq2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian6alllibmono-security2.0-cil< 2.6.7-5.1+deb6u1libmono-security2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian6alllibmono-data1.0-cil< 2.6.7-5.1+deb6u1libmono-data1.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian6alllibmono2.0-cil< 2.6.7-5.1+deb6u1libmono2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian6alllibmono-corlib2.0-cil< 2.6.7-5.1+deb6u1libmono-corlib2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian6alllibmono0-dbg< 2.6.7-5.1+deb6u1libmono0-dbg_2.6.7-5.1+deb6u1_all.deb
Debian6alllibmono-i18n-west1.0-cil< 2.6.7-5.1+deb6u1libmono-i18n-west1.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian6allmono-runtime< 2.6.7-5.1+deb6u1mono-runtime_2.6.7-5.1+deb6u1_all.deb
Debian6alllibmono-management2.0-cil< 2.6.7-5.1+deb6u1libmono-management2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian6allmono-complete< 2.6.7-5.1+deb6u1mono-complete_2.6.7-5.1+deb6u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	all	libmono-messaging-rabbitmq2.0-cil	< 2.6.7-5.1+deb6u1	libmono-messaging-rabbitmq2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian	6	all	libmono-security2.0-cil	< 2.6.7-5.1+deb6u1	libmono-security2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian	6	all	libmono-data1.0-cil	< 2.6.7-5.1+deb6u1	libmono-data1.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian	6	all	libmono2.0-cil	< 2.6.7-5.1+deb6u1	libmono2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian	6	all	libmono-corlib2.0-cil	< 2.6.7-5.1+deb6u1	libmono-corlib2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian	6	all	libmono0-dbg	< 2.6.7-5.1+deb6u1	libmono0-dbg_2.6.7-5.1+deb6u1_all.deb
Debian	6	all	libmono-i18n-west1.0-cil	< 2.6.7-5.1+deb6u1	libmono-i18n-west1.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian	6	all	mono-runtime	< 2.6.7-5.1+deb6u1	mono-runtime_2.6.7-5.1+deb6u1_all.deb
Debian	6	all	libmono-management2.0-cil	< 2.6.7-5.1+deb6u1	libmono-management2.0-cil_2.6.7-5.1+deb6u1_all.deb
Debian	6	all	mono-complete	< 2.6.7-5.1+deb6u1	mono-complete_2.6.7-5.1+deb6u1_all.deb