UbuntuUpdates.org

Package "libnss3"

Name: libnss3

Description:

Network Security Service libraries
Latest version: 2:3.98-0ubuntu0.22.04.5
Release: jammy (22.04)
Level: security
Repository: main
Head package: nss
Homepage: http://www.mozilla.org/projects/security/pki/nss/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libnss3"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libnss3" in Jammy

Repository Area Version
base main 2:3.68.2-0ubuntu1
updates main 2:3.98-0ubuntu0.22.04.4

Changelog

Version: 2:3.98-0ubuntu0.22.04.5 2026-10-21 19:17:43 UTC

nss (2:3.98-0ubuntu0.22.04.5) jammy-security; urgency=medium

  * d/p/certdata-remove-compromised-certs.patch: remove the following
    CA certs from ckfw/builtins/certdata due to intermediate cert
    compromise
    + "emSign ECC Root CA - G3"
    + "Comodo AAA Services root"

 -- Elise Hlady Tue, 20 Oct 2026 16:15:32 -0700
Source diff to previous version

Version: 2:3.98-0ubuntu0.22.04.4 2026-06-29 21:07:30 UTC

  nss (2:3.98-0ubuntu0.22.04.4) jammy-security; urgency=medium

  * SECURITY UPDATE: OOB read in pk11uri_ParseAttributes
    - debian/patches/CVE-2026-12318.patch: improve handling of escape
      sequences in nss/lib/util/pkcs11uri.c.
    - CVE-2026-12318

 -- Marc Deslauriers <email address hidden> Thu, 18 Jun 2026 07:26:25 -0400
Source diff to previous version
CVE-2026-12318 Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Version: 2:3.98-0ubuntu0.22.04.3 2026-03-04 15:08:08 UTC

  nss (2:3.98-0ubuntu0.22.04.3) jammy-security; urgency=medium

  * SECURITY UPDATE: integer overflow in platform-independent ghash
    - debian/patches/CVE-2026-2781.patch: properly cast len in
      nss/lib/freebl/gcm.c.
    - CVE-2026-2781

 -- Marc Deslauriers <email address hidden> Thu, 26 Feb 2026 13:28:10 -0500
Source diff to previous version
CVE-2026-2781 Integer overflow in the Libraries component in NSS. This vulnerability affects Firefox < 148, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird

Version: 2:3.98-0ubuntu0.22.04.2 2024-04-11 20:06:58 UTC

  nss (2:3.98-0ubuntu0.22.04.2) jammy-security; urgency=medium

  * SECURITY REGRESSION: failure to open modules (LP: #2060906)
    - debian/patches/85_security_load.patch: fix broken patch preventing
      module loading.

 -- Marc Deslauriers <email address hidden> Thu, 11 Apr 2024 10:19:22 -0400
Source diff to previous version
2060906 attempt to add opensc using modutil suddenly fails

Version: 2:3.98-0ubuntu0.22.04.1 2024-04-10 15:27:06 UTC

  nss (2:3.98-0ubuntu0.22.04.1) jammy-security; urgency=medium

  * Updated to upstream 3.98 to fix security issues and get a new CA
    certificate bundle.
    - CVE-2023-5388: timing issue in RSA operations
    - CVE-2023-6135: side-channel in multiple NSS NIST curves
  * Removed patches included in new version:
    - debian/patches/set-tls1.2-as-minimum.patch
    - debian/patches/CVE-2022-34480.patch
    - debian/patches/CVE-2023-0767.patch
  * Updated patches for new version:
    - debian/patches/38_hppa.patch
    - debian/patches/85_security_load.patch
    - debian/patches/disable_fips_enabled_read.patch
    - debian/patches/fix-ftbfs-s390x.patch
  * debian/control: bump libnspr version to 2:4.34.
  * debian/libnss3.symbols: added new symbols.

 -- Marc Deslauriers <email address hidden> Thu, 21 Mar 2024 09:44:10 -0400
CVE-2023-5388 NSS was susceptible to a timing side-channel attack when performing RSA decryption. This attack could potentially allow an attacker to recover the pr
CVE-2023-6135 Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to recover the
CVE-2022-34480 Within the <code>lg_init()</code> function, if several allocations succeed but then one fails, an uninitialized pointer would have been freed despite
CVE-2023-0767 An attacker could construct a PKCS 12 cert bundle in such a way that could allow for arbitrary memory writes via PKCS 12 Safe Bag attributes being mi


About   -   Send Feedback to @ubuntu_updates