In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nspr-develUpgrade nspr | May 4, 2022 | Oct 22, 2020 |
| Amazon Linux Ami 2 | — | Upgrade nss-softoknUpgrade nsprUpgrade nss-toolsUpgrade nspr-develUpgrade nss-softokn-develUpgrade nss-sysinitUpgrade nss-pkcs11-develUpgrade nss-util-develUpgrade nss-debuginfoUpgrade nss-softokn-freeblUpgrade nss-utilUpgrade nss-develUpgrade nss-util-debuginfoUpgrade nspr-debuginfoUpgrade nssUpgrade nss-softokn-debuginfoUpgrade nss-softokn-freebl-devel | Nov 12, 2020 | Oct 22, 2020 |
| Amazon_linux | — | Upgrade nss-softoknUpgrade nsprUpgrade nss-util | Jul 13, 2021 | Jan 8, 2020 |
| Centos_linux | — | Upgrade nspr-develUpgrade nss-util-develUpgrade nsprUpgrade nss-softokn-develUpgrade nss-debuginfoUpgrade nss-debugsourceUpgrade nss-softoknUpgrade nss-sysinitUpgrade nss-softokn-freebl-develUpgrade nss-tools-debuginfoUpgrade nss-pkcs11-develUpgrade nss-softokn-freeblUpgrade nspr-debugsourceUpgrade nss-sysinit-debuginfoUpgrade nss-softokn-freebl-debuginfoUpgrade nss-softokn-debuginfoUpgrade nss-toolsUpgrade nss-utilUpgrade nspr-debuginfoUpgrade nss-develUpgrade nss-util-debuginfoUpgrade nss | Aug 4, 2020 | Aug 3, 2020 |
| Debian | — | Upgrade nss | Jan 8, 2020 | Jan 8, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nss-softokn-freebl-develUpgrade nss-softoknUpgrade nss-softokn-develUpgrade nss-softokn-freebl | Feb 2, 2021 | Oct 22, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade nssUpgrade nss-softoknUpgrade nss-util | Jan 5, 2021 | Oct 22, 2020 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 19, 2022 |
| Oracle_linux | — | Upgrade nss-softokn-freeblUpgrade nss-softoknUpgrade nssUpgrade nss-softokn-develUpgrade nspr-develUpgrade nss-sysinitUpgrade nss-toolsUpgrade nsprUpgrade nss-util-develUpgrade nss-develUpgrade nss-utilUpgrade nss-pkcs11-develUpgrade nss-softokn-freebl-devel | Aug 5, 2020 | Dec 26, 2019 |
| Redhat_linux | — | Upgrade nss-sysinit-debuginfoUpgrade nss-tools-debuginfoUpgrade nspr-debuginfoNo solution existsUpgrade nss-util-develUpgrade nss-softokn-freebl-develUpgrade nss-util-debuginfoUpgrade nss-debugsourceUpgrade nspr-debugsourceUpgrade nss-develUpgrade nss-softokn-debuginfoUpgrade nss-pkcs11-develUpgrade nss-softokn-freebl-debuginfoUpgrade nsprUpgrade nss-utilUpgrade nss-softokn-freeblUpgrade nspr-develUpgrade nss-debuginfoUpgrade nss-softoknUpgrade nss-sysinitUpgrade nssUpgrade nss-toolsUpgrade nss-softokn-devel | Aug 4, 2020 | Aug 3, 2020 |
| Rocky_linux | — | Upgrade nsprUpgrade nspr-develUpgrade nspr-debuginfoUpgrade nspr-debugsource | Mar 12, 2024 | Oct 22, 2020 |
| Suse | — | Upgrade libsoftokn3Upgrade libsoftokn3-32bitUpgrade mozilla-nss-sysinitUpgrade mozilla-nss-toolsUpgrade mozilla-nss-32bitUpgrade libfreebl3-32bitUpgrade mozilla-nss-develUpgrade libfreebl3-hmac-32bitUpgrade libsoftokn3-hmac-32bitUpgrade mozilla-nspr-develUpgrade mozilla-nssUpgrade mozilla-nss-certs-32bitUpgrade libsoftokn3-hmacUpgrade mozilla-nsprUpgrade libfreebl3Upgrade libfreebl3-hmacUpgrade mozilla-nss-sysinit-32bitUpgrade mozilla-nss-certsUpgrade mozilla-nspr-32bit | Jan 14, 2020 | Jan 8, 2020 |
| Ubuntu | — | Upgrade libnss3 (Ubuntu Pro)Upgrade libnss3 | Jan 9, 2020 | Jan 8, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Oct 22, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub