nss - security update

Several vulnerabilities were discovered in NSS, the cryptography
library developed by the Mozilla project.

• CVE-2015-4000
  David Adrian et al. reported that it may be feasible to attack
  Diffie-Hellman-based cipher suites in certain circumstances,
  compromising the confidentiality and integrity of data encrypted
  with Transport Layer Security (TLS).
• CVE-2015-7181
  CVE-2015-7182
  CVE-2016-1950
  Tyson Smith, David Keeler, and Francis Gabriel discovered
  heap-based buffer overflows in the ASN.1 DER parser, potentially
  leading to arbitrary code execution.
• CVE-2015-7575
  Karthikeyan Bhargavan discovered that TLS client implementation
  accepted MD5-based signatures for TLS 1.2 connections with forward
  secrecy, weakening the intended security strength of TLS
  connections.
• CVE-2016-1938
  Hanno Boeck discovered that NSS miscomputed the result of integer
  division for certain inputs. This could weaken the cryptographic
  protections provided by NSS. However, NSS implements RSA-CRT leak
  hardening, so RSA private keys are not directly disclosed by this
  issue.
• CVE-2016-1978
  Eric Rescorla discovered a use-after-free vulnerability in the
  implementation of ECDH-based TLS handshakes, with unknown
  consequences.
• CVE-2016-1979
  Tim Taubert discovered a use-after-free vulnerability in ASN.1 DER
  processing, with application-specific impact.
• CVE-2016-2834
  Tyson Smith and Jed Davis discovered unspecified memory-safety
  bugs in NSS.

In addition, the NSS library did not ignore environment variables in
processes which underwent a SUID/SGID/AT_SECURE transition at process
start. In certain system configurations, this allowed local users to
escalate their privileges.

This update contains further correctness and stability fixes without
immediate security impact.

For the stable distribution (jessie), these problems have been fixed in
version 2:3.26-1+debu8u1.

For the unstable distribution (sid), these problems have been fixed in
version 2:3.23-1.

We recommend that you upgrade your nss packages.