Summary
Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7
sequence. A remote attacker could possibly use this issue to cause NSS to
crash, resulting in a denial of service. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-22747)
Ronald Crane discovered that NSS incorrectly handled certain memory
operations. A remote attacker could use this issue to cause NSS to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2022-34480)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | nss | 2:3.35-2ubuntu2.15 |
| Ubuntu · 20.04 LTS 20.04:LTS | nss | 2:3.49.1-1ubuntu1.8 |
| Ubuntu · 22.04 LTS 22.04:LTS | nss | 2:3.68.2-0ubuntu1.1 |
Vulnerabilities 2
-
High 8.8
Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer…
-
Medium 6.5
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…