Summary
Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7
sequence. A remote attacker could possibly use this issue to cause NSS to
crash, resulting in a denial of service. (CVE-2022-22747)
Ronald Crane discovered that NSS incorrectly handled certain memory
operations. A remote attacker could use this issue to cause NSS to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2022-34480)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | nss | 2:3.28.4-0ubuntu0.14.04.5+esm11 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | nss | 2:3.28.4-0ubuntu0.16.04.14+esm3 |
Vulnerabilities 2
-
High 8.8
Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer…
-
Medium 6.5
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…