USN-3431-1: NSS vulnerability
Martin Thomson discovered that NSS incorrectly generated handshake hashes. A remote attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this NSS vulnerability?
The vulnerability ID for this NSS vulnerability is CVE-2017-7805.
What is the severity of NSS CVE-2017-7805 vulnerability?
The severity of NSS CVE-2017-7805 vulnerability is high.
How does an attacker exploit CVE-2017-7805?
An attacker can exploit CVE-2017-7805 by generating malformed handshake packets.
How can I fix the NSS CVE-2017-7805 vulnerability?
To fix the NSS CVE-2017-7805 vulnerability, update the libnss3 package to version 2:3.28.4-0ubuntu0.17.04.3 (for Ubuntu 17.04), 2:3.28.4-0ubuntu0.16.04.3 (for Ubuntu 16.04), or 2:3.28.4-0ubuntu0.14.04.3 (for Ubuntu 14.04).
Where can I find more information about the NSS vulnerability?
You can find more information about the NSS vulnerability at the following references: [1](https://ubuntu.com/security/CVE-2017-7805), [2](https://ubuntu.com/security/notices/USN-3436-1), [3](https://ubuntu.com/security/notices/USN-3435-1).