USN-3336-1: NSS vulnerability
Published Jun 21, 2017
·Updated
It was discovered that NSS incorrectly handled certain empty SSLv2 messages. A remote attacker could possibly use this issue to cause NSS to crash, resulting in a denial of service.
Affected Software
8 affected componentsFixes available
All of the following
ubuntu/libnss3<2:3.28.4-0ubuntu0.17.04.2
2:3.28.4-0ubuntu0.17.04.2
Ubuntu Ubuntu=17.04
All of the following
ubuntu/libnss3<2:3.28.4-0ubuntu0.16.10.2
2:3.28.4-0ubuntu0.16.10.2
Ubuntu Ubuntu=16.10
All of the following
ubuntu/libnss3<2:3.28.4-0ubuntu0.16.04.2
2:3.28.4-0ubuntu0.16.04.2
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libnss3<2:3.28.4-0ubuntu0.14.04.2
2:3.28.4-0ubuntu0.14.04.2
Ubuntu Ubuntu=14.04
Event History
Jun 21, 2017
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-3336-1?
USN-3336-1 is classified as a denial of service vulnerability.
2
How do I fix USN-3336-1?
To resolve USN-3336-1, upgrade libnss3 to the patched version appropriate for your Ubuntu release.
3
Which Ubuntu versions are affected by USN-3336-1?
USN-3336-1 affects Ubuntu versions 14.04, 16.04, 16.10, and 17.04.
4
What vulnerability does USN-3336-1 address?
USN-3336-1 addresses a vulnerability where NSS incorrectly handled certain empty SSLv2 messages.
5
Can USN-3336-1 lead to system crashes?
Yes, a successful exploit of USN-3336-1 can potentially lead to remote system crashes.