[SECURITY] [DLA 480-1] nss security update

Package : nss
Version : 3.14.5-1+deb7u6
CVE ID : CVE-2015-7181 CVE-2015-7182 CVE-2016-1938 CVE-2016-1950
CVE-2016-1978 CVE-2016-1979

This security update fixes serious security issues in NSS including
arbitrary code execution and remote denial service attacks.

For Debian 7 "wheezy", these problems have been fixed in
3.14.5-1+deb7u6. We recommend you upgrade your nss packages as soon as
possible.

CVE-2015-7181

The sec_asn1d_parse_leaf function improperly restricts access to
an unspecified data structure.

CVE-2015-7182

Heap-based buffer overflow in the ASN.1 decoder.

CVE-2016-1938

The s_mp_div function in lib/freebl/mpi/mpi.c in improperly
divides numbers, which might make it easier for remote attackers
to defeat cryptographic protection mechanisms.

CVE-2016-1950

Heap-based buffer overflow allows remote attackers to execute
arbitrary code via crafted ASN.1 data in an X.509 certificate.

CVE-2016-1978

Use-after-free vulnerability in the ssl3_HandleECDHServerKeyExchange
function allows remote attackers to cause a denial of service or
possibly have unspecified other impact by making an SSL (1) DHE or
(2) ECDHE handshake at a time of high memory consumption.

CVE-2016-1979

Use-after-free vulnerability in the PK11_ImportDERPrivateKeyInfoAndReturnKey
function allows remote attackers to cause a denial of service or
possibly have unspecified other impact via crafted key data with
DER encoding.

Further information about Debian LTS security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS