Every CVE Search/ Get API key

CVE-2022-3479

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a...

7.5 HighFix available

CVE-2022-3479 is a high vulnerability (CVSS 7.5) in Mozilla Nss, published October 14, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in nss 3.85-r1.

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.96%Up 0.1 points since Oct 15, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

Record
CVE-2022-3479
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
CVE List No score

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

Record
CVE-2022-3479
Updated
2026-11-02
EUVDEUVD-2022-42851 No score

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

Record
EUVD-2022-42851
Updated
2026-11-03
GitHub AdvisoriesGHSA-6275-5f4x-m3m3 7.5

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a...

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

Record
GHSA-6275-5f4x-m3m3
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALPINE-CVE-2022-3479 7.5

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

Record
ALPINE-CVE-2022-3479
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVBELL-CVE-2022-3479 7.5

CVE-2022-3479 does not affect BellSoft software

Record
BELL-CVE-2022-3479
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 10 moreShow less
OSV 7.5

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

Record
CVE-2022-3479
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1211 7.5

firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Security Fix(es):

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.(CVE-2022-3479)

Record
OESA-2024-1211
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1212 7.5

firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Security Fix(es):

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.(CVE-2022-3479)

Record
OESA-2024-1212
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1213 7.5

firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Security Fix(es):

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.(CVE-2022-3479)

Record
OESA-2024-1213
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1214 7.5

firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions.

Security Fix(es):

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.(CVE-2022-3479)

Record
OESA-2024-1214
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2022-3479 No score

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

Record
DEBIAN-CVE-2022-3479
Updated
2026-11-03
OSVMGASA-2023-0018 No score

Updated firefox packages fix security vulnerability

A vulnerability was found in NSS. The NSS client auth crashes without a user certificate in the database, leading to a segmentation fault or crash (CVE-2022-3479).

An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited (CVE-2022-46871).

By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks (CVE-2022-46877).

Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData (CVE-2023-23598).

Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks (CVE-2023-23601).

A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. This could lead to connections to restricted origins from inside WebWorkers (CVE-2023-23602).

Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log weren't accounting for external URLs, allowing bypassing Content Security Policy via format directives. Data could then be potentially exfiltrated from the browser (CVE-2023-23603).

Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox ESR 102.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2023-23605).

Record
MGASA-2023-0018
Updated
2026-11-02
OSVSUSE-SU-2023:0118-1 No score

Security update for mozilla-nss

This update for mozilla-nss fixes the following issues:

  • CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but the client had no certificates stored (bsc#1204272).
  • Updated to version 3.79.3 (bsc#1207038):
    • CVE-2022-23491: Removed trust for 3 root certificates from TrustCor.
Record
SUSE-SU-2023:0118-1
Updated
2026-11-02
OSVSUSE-SU-2023:0119-1 No score

Security update for mozilla-nss

This update for mozilla-nss fixes the following issues:

  • CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but the client had no certificates stored (bsc#1204272).
  • Updated to version 3.79.3 (bsc#1207038):
    • CVE-2022-23491: Removed trust for 3 root certificates from TrustCor.
Record
SUSE-SU-2023:0119-1
Updated
2026-11-02
OSVSUSE-SU-2023:0130-1 No score

Security update for mozilla-nss

This update for mozilla-nss fixes the following issues:

  • CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but the client had no certificates stored (bsc#1204272).
  • Updated to version 3.79.3 (bsc#1207038):
    • CVE-2022-23491: Removed trust for 3 root certificates from TrustCor.
Record
SUSE-SU-2023:0130-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nss
Alpine:v3.17
 before 3.85-r1
3.85-r1
nss
Debian:12
 before 2:3.87-1
2:3.87-1
nss
Debian:13
 before 2:3.87-1
2:3.87-1
nss
Debian:14
 before 2:3.87-1
2:3.87-1
firefox
Mageia:8
 before 102.7.0-1.mga8
102.7.0-1.mga8
firefox-l10n
Mageia:8
 before 102.7.0-1.mga8
102.7.0-1.mga8
nss
Mageia:8
 before 3.87.0-1.mga8
3.87.0-1.mga8
firefox
openEuler:22.03-LTS
 before 102.15.0-5.oe2203
102.15.0-5.oe2203
firefox
openEuler:22.03-LTS-SP1
 before 102.15.0-5.oe2203sp1
102.15.0-5.oe2203sp1
firefox
openEuler:22.03-LTS-SP2
 before 102.15.0-5.oe2203sp2
102.15.0-5.oe2203sp2
Show 33 moreShow less
Affected packages
PackageAffectedFixed
firefox
openEuler:22.03-LTS-SP3
 before 102.15.0-5.oe2203sp3
102.15.0-5.oe2203sp3
mozilla-nss
SUSE:OpenStack Cloud 9
 before 3.79.3-58.91.1
3.79.3-58.91.1
mozilla-nss
SUSE:OpenStack Cloud Crowbar 9
 before 3.79.3-58.91.1
3.79.3-58.91.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.79.3-58.91.1
3.79.3-58.91.1
mozilla-nss
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.79.3-58.91.1
3.79.3-58.91.1
mozilla-nss
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.79.3-58.91.1
3.79.3-58.91.1
mozilla-nss
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 3.79.3-58.91.1
3.79.3-58.91.1
mozilla-nss
SUSE:Linux Enterprise Server 12 SP5
 before 3.79.3-58.91.1
3.79.3-58.91.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.79.3-58.91.1
3.79.3-58.91.1
mozilla-nss
SUSE:Linux Enterprise Micro 5.3
 before 3.79.3-150400.3.23.1
3.79.3-150400.3.23.1
mozilla-nss
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 3.79.3-150400.3.23.1
3.79.3-150400.3.23.1
mozilla-nss
openSUSE:Leap Micro 5.3
 before 3.79.3-150400.3.23.1
3.79.3-150400.3.23.1
mozilla-nss
openSUSE:Leap 15.4
 before 3.79.3-150400.3.23.1
3.79.3-150400.3.23.1
mozilla-nss
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise Real Time 15 SP3
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Manager Proxy 4.2
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Manager Retail Branch Server 4.2
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Manager Server 4.2
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise Micro 5.1
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Linux Enterprise Micro 5.2
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Enterprise Storage 6
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Enterprise Storage 7
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
SUSE:Enterprise Storage 7.1
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1
mozilla-nss
openSUSE:Leap Micro 5.2
 before 3.79.3-150000.3.90.1
3.79.3-150000.3.90.1

History

History
WhenChangedSources
2026-11-03affected, aliases, referencesOSV
2026-11-03aliases, productsEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open