USN-3163-1: nss Ubuntu
Vulnerability summary
USN-3163-1 is a vulnerability in nss Ubuntu with no CVSS score yet.
Advisory lineage
Upstream 3 · Downstream 0 · Related 3Timeline
- 04-01-2017PublishedVulnerability first disclosed.
- 22-04-2026Last modifiedVulnerability information updated.
Description
nss vulnerabilities It was discovered that NSS incorrectly handled certain invalid Diffie-Hellman keys. A remote attacker could possibly use this flaw to cause NSS to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-5285) Hubert Kario discovered that NSS incorrectly handled Diffie Hellman client key exchanges. A remote attacker could possibly use this flaw to perform a small subgroup confinement attack and recover private keys. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8635) Franziskus Kiefer discovered that NSS incorrectly mitigated certain timing side-channel attacks. A remote attacker could possibly use this flaw to recover private keys. (CVE-2016-9074) This update refreshes the NSS package to version 3.26.2 which includes the latest CA certificate bundle.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- nss< 2:3.26.2-0ubuntu0.14.04.3 | < 2:3.26.2-0ubuntu0.16.04.2
1 vendor · 1 product