NSS vulnerabilities

Releases

• Ubuntu 12.04

Packages

• nss - Network Security Service library

Details

USN-3850-1 fixed several vulnerabilities in NSS. This update provides
the corresponding update for Ubuntu 12.04 ESM.

Original advisory details:

Keegan Ryan discovered that NSS incorrectly handled ECDSA key generation.
A local attacker could possibly use this issue to perform a cache-timing
attack and recover private ECDSA keys. (CVE-2018-0495)

It was discovered that NSS incorrectly handled certain v2-compatible
ClientHello messages. A remote attacker could possibly use this issue to
perform a replay attack. (CVE-2018-12384)

It was discovered that NSS incorrectly handled certain padding oracles. A
remote attacker could possibly use this issue to perform a variant of the
Bleichenbacher attack. (CVE-2018-12404)