USN-5506-1: NSS vulnerabilities

Releases

• Ubuntu 22.04 LTS
• Ubuntu 21.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• nss - Network Security Service library

Details

Tavis Ormandy discovered that NSS incorrectly handled an empty pkcs7
sequence. A remote attacker could possibly use this issue to cause NSS to
crash, resulting in a denial of service. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.10. (CVE-2022-22747)

Ronald Crane discovered that NSS incorrectly handled certain memory
operations. A remote attacker could use this issue to cause NSS to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2022-34480)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 22.04

• libnss3 - 2:3.68.2-0ubuntu1.1

Ubuntu 21.10

• libnss3 - 2:3.68-1ubuntu1.2

Ubuntu 20.04

• libnss3 - 2:3.49.1-1ubuntu1.8

Ubuntu 18.04

• libnss3 - 2:3.35-2ubuntu2.15

After a standard system update you need to restart any applications that
use NSS to make all the necessary changes.

References

• CVE-2022-22747
• CVE-2022-34480

Related notices

• USN-5229-1
• USN-5246-1
• USN-5248-1
• USN-5872-1
• USN-5504-1