Ubuntu 22.04 LTS USN-5506-1 Moderate: NSS Denial of Service Issues Fixed

ubuntu

July 7, 2022

Several security issues were fixed in NSS.

Summary

Several security issues were fixed in NSS.

Software Description:

- nss: Network Security Service library

Details:

Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7

sequence. A remote attacker could possibly use this issue to cause NSS to

crash, resulting in a denial of service. This issue only affected Ubuntu

18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-22747)

Ronald Crane discovered that NSS incorrectly handled certain memory

operations. A remote attacker could use this issue to cause NSS to crash,

resulting in a denial of service, or possibly execute arbitrary code.

(CVE-2022-34480)

Topics Covered

security advisory remote attack Ubuntu moderate severity update instructions Denial of Service NSS

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS:
  libnss3                         2:3.68.2-0ubuntu1.1

Ubuntu 21.10:
  libnss3                         2:3.68-1ubuntu1.2

Ubuntu 20.04 LTS:
  libnss3                         2:3.49.1-1ubuntu1.8

Ubuntu 18.04 LTS:
  libnss3                         2:3.35-2ubuntu2.15

After a standard system update you need to restart any applications that
use NSS to make all the necessary changes.