Debian-LTS alert DLA-315-1 (nss)

From:
    	     
 
Guido Günther <agx@sigxcpu.org> 
To:
    	     
 
debian-lts-announce@lists.debian.org 
Subject:
    	     
 
[SECURITY] [DLA 315-1] nss security update 
Date:
    	     
 
Sun, 27 Sep 2015 13:36:03 +0200
Message-ID:
    	     
 
<20150927113603.GA20459@bogon.m.sigxcpu.org>
Package        : nss
Version        : 3.12.8-1+squeeze12
CVE ID         : CVE-2015-2721 CVE-2015-2730

Several vulnerabilities have been discovered in nss, the Mozilla Network
Security Service library. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2015-2721

    Karthikeyan Bhargavan discovered that NSS incorrectly handles state
    transitions for the TLS state machine. A man-in-the-middle attacker
    could exploit this flaw to skip the ServerKeyExchange message and
    remove the forward-secrecy property.

CVE-2015-2730

    Watson Ladd discovered that NSS does not properly perform Elliptical
    Curve Cryptography (ECC) multiplication, allowing a remote attacker
    to potentially spoof ECDSA signatures.

For the oldoldstable distribution (squeeze), these problems have been fixed
in version 3.12.8-1+squeeze12.

We recommend that you upgrade your nss packages.