From 11da47024acae1cbb4a23795eedd58c6346a7b388c9a8c36ec898c1f12178c14 Mon Sep 17 00:00:00 2001 From: Wolfgang Rosenauer Date: Fri, 3 Jul 2015 05:51:39 +0000 Subject: [PATCH] (MFSA 2015-70/CVE-2015-4000) * NSS incorrectly permits skipping of ServerKeyExchange (bmo#1086145) (MFSA 2015-71/CVE-2015-2721) OBS-URL: https://build.opensuse.org/package/show/mozilla:Factory/mozilla-nss?expand=0&rev=187 --- mozilla-nss.changes | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mozilla-nss.changes b/mozilla-nss.changes index 5c0d492..204398c 100644 --- a/mozilla-nss.changes +++ b/mozilla-nss.changes @@ -33,11 +33,14 @@ Sun May 31 13:22:47 UTC 2015 - wr@rosenauer.org * The minimum strength of keys that libssl will accept for finite field algorithms (RSA, Diffie-Hellman, and DSA) have been increased to 1023 bits (bmo#1138554). + (MFSA 2015-70/CVE-2015-4000) * NSS reports the bit length of keys more accurately. Thus, the SECKEY_PublicKeyStrength and SECKEY_PublicKeyStrengthInBits functions could report smaller values for values that have leading zero values. This affects the key strength values that are reported by SSL_GetChannelInfo. + * NSS incorrectly permits skipping of ServerKeyExchange + (bmo#1086145) (MFSA 2015-71/CVE-2015-2721) ------------------------------------------------------------------- Sat May 23 07:36:27 UTC 2015 - wr@rosenauer.org