Preisgabe von Informationen in NSS
ID: | USN-2864-1 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 15.04, Ubuntu 15.10 |
Datum: | Fr, 8. Januar 2016, 09:10 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7575 |
Applikationen: | NSS |
Originalnachricht |
|
This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --===============1727867077354601799== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="IU3FWflKnWRvbQi7Bm6M3GC3Ru9HTln1F" This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --IU3FWflKnWRvbQi7Bm6M3GC3Ru9HTln1F Content-Type: text/plain; charset=utf- Content-Transfer-Encoding: quoted-printable ========================================================================== Ubuntu Security Notice USN-2864-1 January 07, 2016 nss vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 15.10 - Ubuntu 15.04 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: NSS could be made to expose sensitive information over the network. Software Description: - nss: Network Security Service library Details: Karthikeyan Bhargavan and Gaetan Leurent discovered that NSS incorrectly allowed MD5 to be used for TLS 1.2 connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 15.10: libnss3 2:3.19.2.1-0ubuntu0.15.10.2 Ubuntu 15.04: libnss3 2:3.19.2.1-0ubuntu0.15.04.2 Ubuntu 14.04 LTS: libnss3 2:3.19.2.1-0ubuntu0.14.04.2 Ubuntu 12.04 LTS: libnss3 3.19.2.1-0ubuntu0.12.04.2 After a standard system update you need to restart any applications that use NSS, such as Evolution and Chromium, to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-2864-1 CVE-2015-7575 Package Information: https://launchpad.net/ubuntu/+source/nss/2:3.19.2.1-0ubuntu0.15.10.2 https://launchpad.net/ubuntu/+source/nss/2:3.19.2.1-0ubuntu0.15.04.2 https://launchpad.net/ubuntu/+source/nss/2:3.19.2.1-0ubuntu0.14.04.2 https://launchpad.net/ubuntu/+source/nss/3.19.2.1-0ubuntu0.12.04.2 --IU3FWflKnWRvbQi7Bm6M3GC3Ru9HTln1F Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIbBAEBCgAGBQJWjtHMAAoJEGVp2FWnRL6TDvcP+KtFtBx7ybi7nOAiox1/sccW RF5oy0qPQkb7DoxF49Lure8iHXgGIalVEfKIyyXga06muugP0d3joxwGsLmQtoKO M47SpynUSgshKEIR48QOMI2NMXH4zpS9s9OgCr5j35EBr6Ki0/X1AcOYNWd6Y521 Y/4CeOfJklF0z8rKE3Kz0ErzqC0Dl1VIus96upF/RclRIxTdKEItLfM8/nTqUyip 4HJM3bqxd7uHkDAA41LV/bFYpE8HsM5cX9BsttAnlbDaqljoU9i7Rn1OlwmiPSuc Brg5LxjojtvTO4uyMYtnnlh+w08qWxc44jXAnnI2CJtBk727LoWOLzkDXHCKVMG6 kyTBzRE1MibwRdlmI1pl1bvsatDxUi1QauI4FJZofeNvRMBDp5l2V2jomFLvNC2Q L4Cdl/MSeZ4yuTU6ZrdbEHSFs76pBOuTWl6fYRdMDVVn2PU2h+V8k3Al5uX6mcyy d6eTuXaeyyvKBTpAVy5r5HNt2mu+C+AszO64oXlc9KgvR7opd+kUywMtYk5wzNF4 qTDV+8lFMr2lThIIIt9wSdTf7Us+dSHIhLgzgPFNkkMXDlTO/NSRg0eWBOVA0zf4 vHX6+2txUaQ6c/rQwz7Uy6FlD9Jv+kybTwrGxlTFUjS9LiTWbJyPxn0HJz9CyM06 KXFqu3Hm7tYjcIpUDec= =Jd73 -----END PGP SIGNATURE----- --IU3FWflKnWRvbQi7Bm6M3GC3Ru9HTln1F-- --===============1727867077354601799== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce --===============1727867077354601799==-- |