USN-2159-1: NSS vulnerability

Ubuntu Security Notice USN-2159-1

2nd April, 2014

nss vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 13.10


• Ubuntu 12.10


• Ubuntu 12.04 LTS


• Ubuntu 10.04 LTS

Summary

NSS could be made to expose sensitive information over the network.

Software description

• nss - Network Security Service library

Details

It was discovered that NSS incorrectly handled wildcard certificates when

used with internationalized domain names. If a remote attacker were able to

perform a man-in-the-middle attack, this flaw could be exploited to spoof

SSL servers.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 13.10:

libnss3 2:3.15.4-0ubuntu0.13.10.2

Ubuntu 12.10:

libnss3 3.15.4-0ubuntu0.12.10.2

Ubuntu 12.04 LTS:

libnss3 3.15.4-0ubuntu0.12.04.2

Ubuntu 10.04 LTS:

libnss3-1d 3.15.4-0ubuntu0.10.04.2

To update your system, please follow these instructions: http://bit.ly/1aJDvTw.

After a standard system update you need to restart any applications that

use NSS, such as Evolution and Chromium, to make all the necessary changes.

References

CVE-2014-1492

via Ubuntu Security Notices http://bit.ly/1i2sgrL