CVE-2016-9074
Ubuntu Security Notice USN-3163-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An existing mitigation of timing side-channel attacks is insufficient in some circumstances. This issue is addressed in Network Security Services (NSS) 3.26.1. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
Una mitigación existente de los ataques de sincronización por canal lateral es insuficiente en determinadas circunstancias. Este problema se aborda en Network Security Services (NSS) 3.26.1. La vulnerabilidad afecta a Thunderbird en versiones anteriores a la 45.5, Firefox ESR en versiones anteriores a la 45.5 y Firefox en versiones anteriores a la 50.
It was discovered that NSS incorrectly handled certain invalid Diffie-Hellman keys. A remote attacker could possibly use this flaw to cause NSS to crash, resulting in a denial of service. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. Hubert Kario discovered that NSS incorrectly handled Diffie Hellman client key exchanges. A remote attacker could possibly use this flaw to perform a small subgroup confinement attack and recover private keys. This issue only applied to Ubuntu 12.04 LTS, Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. Various other issues were also addressed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-10-27 CVE Reserved
- 2016-11-17 CVE Published
- 2024-08-06 CVE Updated
- 2025-05-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/94341 | Third Party Advisory | |
| http://www.securitytracker.com/id/1037298 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=1293334 | 2018-08-09 | |
| https://security.gentoo.org/glsa/201701-15 | 2018-08-09 | |
| https://security.gentoo.org/glsa/201701-46 | 2018-08-09 | |
| https://www.debian.org/security/2016/dsa-3730 | 2018-08-09 | |
| https://www.mozilla.org/security/advisories/mfsa2016-89 | 2018-08-09 | |
| https://www.mozilla.org/security/advisories/mfsa2016-90 | 2018-08-09 | |
| https://www.mozilla.org/security/advisories/mfsa2016-93 | 2018-08-09 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 50.0 Search vendor "Mozilla" for product "Firefox" and version " < 50.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 45.5.0 Search vendor "Mozilla" for product "Firefox Esr" and version " < 45.5.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 45.5.0 Search vendor "Mozilla" for product "Thunderbird" and version " < 45.5.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||