[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

[SECURITY] [DLA 354-1] nss security update



Package        : nss
Version        : 3.12.8-1+squeeze13
CVE ID         : CVE-2015-7181 CVE-2015-7182
Debian Bug     : 

Several vulnerabilities have been discovered in nss, the Mozilla Network
Security Service library. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2015-7181

    The sec_asn1d_parse_leaf function improperly restricts access to an
    unspecified data structure, which allows remote attackers to cause a
    denial of service (application crash) or possibly execute arbitrary
    code via crafted OCTET STRING data, related to a "use-after-poison"
    issue.

CVE-2015-7182

     A Heap-based buffer overflow in the ASN.1 decoder allows remote
     attackers to cause a denial of service (application crash) or
     possibly execute arbitrary code via crafted OCTET STRING data.

For the oldoldstable distribution (squeeze), these problems have been fixed
in version 3.12.8-1+squeeze13.

We recommend that you upgrade your nss packages.

Attachment: signature.asc
Description: PGP signature


Reply to: