USN-5892-1: NSS vulnerabilities
Published Feb 27, 2023
·Updated
It was discovered that NSS incorrectly handled client authentication without a user certificate in the database. A remote attacker could possibly use this issue to cause a NSS client to crash, resulting in a denial of service. This issue only affected Ubuntu 22.10. (CVE-2022-3479) Christian Holler discovered that NSS incorrectly handled certain PKCS 12 certificated bundles. A remote attacker could use this issue to cause NSS to crash, leading to a denial of service, or possibly execute arbitrary code. (CVE-2023-0767)
Affected Software
8 affected componentsFixes available
All of the following
ubuntu/libnss3<2:3.82-1ubuntu0.1
2:3.82-1ubuntu0.1
Ubuntu Ubuntu=22.10
All of the following
ubuntu/libnss3<2:3.68.2-0ubuntu1.2
2:3.68.2-0ubuntu1.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libnss3<2:3.49.1-1ubuntu1.9
2:3.49.1-1ubuntu1.9
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libnss3<2:3.35-2ubuntu2.16
2:3.35-2ubuntu2.16
Ubuntu Ubuntu=18.04
Event History
Feb 27, 2023
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the vulnerability ID for this security notice?
CVE-2022-3479
2
Which software is affected by this vulnerability?
libnss3
3
How can a remote attacker exploit this vulnerability?
By causing a NSS client to crash, resulting in a denial of service.
4
Which version of Ubuntu is affected by this vulnerability?
Ubuntu 22.10
5
How can I fix this vulnerability?
Update the libnss3 package to version 2:3.82-1ubuntu0.1 or later.