USN-1106-1: NSS vulnerabilities

Releases

• Ubuntu 10.10
• Ubuntu 10.04
• Ubuntu 9.10
• Ubuntu 8.04

Packages

• nss - Transition package for Network Security Service libraries

Details

It was discovered that several invalid HTTPS certificates were issued and
revoked. An attacker could exploit these to perform a machine-in-the-middle
attack to view sensitive information or alter encrypted communications.
These certificates were marked as explicitly not trusted to prevent their
misuse.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.10

• libnss3-1d - 3.12.9+ckbi-1.82-0ubuntu0.9.10.1

Ubuntu 8.04

• libnss3-1d - 3.12.9+ckbi-1.82-0ubuntu0.8.04.1

Ubuntu 10.10

• libnss3-1d - 3.12.9+ckbi-1.82-0ubuntu0.10.10.1

Ubuntu 10.04

• libnss3-1d - 3.12.9+ckbi-1.82-0ubuntu0.10.04.1

After a standard system update you need to restart any applications that
use NSS, such as Thunderbird or Evolution, to make all the necessary
changes.

References

• https://launchpad.net/bugs/741729