Summary
It was discovered that NSS incorrectly handled client authentication
without a user certificate in the database. A remote attacker could
possibly use this issue to cause a NSS client to crash, resulting in a
denial of service. This issue only affected Ubuntu 22.10. (CVE-2022-3479)
Christian Holler discovered that NSS incorrectly handled certain PKCS 12
certificated bundles. A remote attacker could use this issue to cause NSS
to crash, leading to a denial of service, or possibly execute arbitrary
code. (CVE-2023-0767)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | nss | 2:3.35-2ubuntu2.16 |
| Ubuntu · 20.04 LTS 20.04:LTS | nss | 2:3.49.1-1ubuntu1.9 |
| Ubuntu · 22.04 LTS 22.04:LTS | nss | 2:3.68.2-0ubuntu1.2 |
Vulnerabilities 1
-
High 8.8
An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 1…