logo
DATABASE RESOURCES PRICING ABOUT US

NSS vulnerabilities

Description

It was discovered that NSS incorrectly handled certain invalid Diffie-Hellman keys. A remote attacker could possibly use this flaw to cause NSS to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5285) Hubert Kario discovered that NSS incorrectly handled Diffie Hellman client key exchanges. A remote attacker could possibly use this flaw to perform a small subgroup confinement attack and recover private keys. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8635) Franziskus Kiefer discovered that NSS incorrectly mitigated certain timing side-channel attacks. A remote attacker could possibly use this flaw to recover private keys. (CVE-2016-9074) This update refreshes the NSS package to version 3.26.2 which includes the latest CA certificate bundle.


Affected Package


OS OS Version Package Name Package Version
Ubuntu 16.10 libnss3 2:3.26.2-0ubuntu0.16.10.1
Ubuntu 16.04 libnss3 2:3.26.2-0ubuntu0.16.04.2
Ubuntu 16.04 libnss3-1d 2:3.26.2-0ubuntu0.16.04.2
Ubuntu 16.04 libnss3-dbg 2:3.26.2-0ubuntu0.16.04.2
Ubuntu 16.04 libnss3-dbgsym 2:3.26.2-0ubuntu0.16.04.2
Ubuntu 16.04 libnss3-dev 2:3.26.2-0ubuntu0.16.04.2
Ubuntu 16.04 libnss3-nssdb 2:3.26.2-0ubuntu0.16.04.2
Ubuntu 16.04 libnss3-tools 2:3.26.2-0ubuntu0.16.04.2
Ubuntu 16.04 libnss3-tools-dbgsym 2:3.26.2-0ubuntu0.16.04.2
Ubuntu 14.04 libnss3 2:3.26.2-0ubuntu0.14.04.3
Ubuntu 14.04 libnss3-1d 2:3.26.2-0ubuntu0.14.04.3
Ubuntu 14.04 libnss3-dbg 2:3.26.2-0ubuntu0.14.04.3
Ubuntu 14.04 libnss3-dev 2:3.26.2-0ubuntu0.14.04.3
Ubuntu 14.04 libnss3-nssdb 2:3.26.2-0ubuntu0.14.04.3
Ubuntu 14.04 libnss3-tools 2:3.26.2-0ubuntu0.14.04.3
Ubuntu 12.04 libnss3 2:3.26.2-0ubuntu0.12.04.1

Related