=========================================================================== Ubuntu Security Notice USN-3163-1 January 04, 2017 nss vulnerabilities =========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.10 - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS Summary: Several security issues were fixed in NSS. Software Description: - nss: Network Security Service library Details: It was discovered that NSS incorrectly handled certain invalid Diffie-Hellman keys. A remote attacker could possibly use this flaw to cause NSS to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5285) Hubert Kario discovered that NSS incorrectly handled Diffie Hellman client key exchanges. A remote attacker could possibly use this flaw to perform a small subgroup confinement attack and recover private keys. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8635) Franziskus Kiefer discovered that NSS incorrectly mitigated certain timing side-channel attacks. A remote attacker could possibly use this flaw to recover private keys. (CVE-2016-9074) This update refreshes the NSS package to version 3.26.2 which includes the latest CA certificate bundle. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 16.10: libnss3 2:3.26.2-0ubuntu0.16.10.1 Ubuntu 16.04 LTS: libnss3 2:3.26.2-0ubuntu0.16.04.2 Ubuntu 14.04 LTS: libnss3 2:3.26.2-0ubuntu0.14.04.3 Ubuntu 12.04 LTS: libnss3 2:3.26.2-0ubuntu0.12.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any applications that use NSS, such as Evolution and Chromium, to make all the necessary changes. References: http://www.ubuntu.com/usn/usn-3163-1 CVE-2016-5285, CVE-2016-8635, CVE-2016-9074 Package Information: https://launchpad.net/ubuntu/+source/nss/2:3.26.2-0ubuntu0.16.10.1 https://launchpad.net/ubuntu/+source/nss/2:3.26.2-0ubuntu0.16.04.2 https://launchpad.net/ubuntu/+source/nss/2:3.26.2-0ubuntu0.14.04.3 https://launchpad.net/ubuntu/+source/nss/2:3.26.2-0ubuntu0.12.04.1