Summary
Karthik Bhargavan and Gaetan Leurent discovered that the DES and Triple DES
ciphers were vulnerable to birthday attacks. A remote attacker could
possibly use this flaw to obtain clear text data from long encrypted
sessions. This update causes NSS to limit use of the same symmetric key.
(CVE-2016-2183)
It was discovered that NSS incorrectly handled Base64 decoding. A remote
attacker could use this flaw to cause NSS to crash, resulting in a denial
of service, or possibly execute arbitrary code. (CVE-2017-5461)
This update refreshes the NSS package to version 3.28.4 which includes
the latest CA certificate bundle.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | nss | 2:3.28.4-0ubuntu0.14.04.1 |
| Ubuntu · 16.04 LTS 16.04:LTS | nss | 2:3.28.4-0ubuntu0.16.04.1 |
Vulnerabilities 2
-
High 7.5
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a b…
-
Unscored —
Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3…