Every CVE Search/ Get API key

CVE-2020-12403

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55....

9.1 CriticalFix available

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

1.54%Up 0.9 points since May 28, 2021
90%50%10%1%

What each source reports

NVD Score used 9.1

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Record
CVE-2020-12403
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 2.0
6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness
CWE-125
Updated
2026-11-02
CVE List No score

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Record
CVE-2020-12403
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2020-4715 No score

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Record
EUVD-2020-4715
Updated
2026-11-03
GitHub AdvisoriesGHSA-9h25-47mw-52hh 9.1

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55....

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Record
GHSA-9h25-47mw-52hh
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSVALPINE-CVE-2020-12403 9.1

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Record
ALPINE-CVE-2020-12403
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-03
OSVAZL-6746 9.1

CVE-2020-12403 affecting package nss for versions less than 3.44-10

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Record
AZL-6746
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 19 moreShow less
OSVBELL-CVE-2020-12403 9.1

CVE-2020-12403 does not affect BellSoft software

Record
BELL-CVE-2020-12403
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSV 9.1

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Record
CVE-2020-12403
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-12403 9.1

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Record
DEBIAN-CVE-2020-12403
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2021-1115 7.5

nss security update

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

Security Fix(es):

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.(CVE-2020-12403)

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.(CVE-2020-25648)

Record
OESA-2021-1115
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2021-1116 7.5

nss security update

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.

Security Fix(es):

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.(CVE-2020-12403)

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.(CVE-2020-25648)

Record
OESA-2021-1116
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:4076 8.1

Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

Record
RHSA-2020:4076
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0538 7.4

Red Hat Security Advisory: nss security and bug fix update

Record
RHSA-2021:0538
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRHSA-2021:0758 8.1

Red Hat Security Advisory: nss-softokn security update

Record
RHSA-2021:0758
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:0876 8.1

Red Hat Security Advisory: nss and nss-softokn security update

Record
RHSA-2021:0876
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:1026 8.1

Red Hat Security Advisory: nss-softokn security update

Record
RHSA-2021:1026
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2021:0538 7.4

Moderate: nss security and bug fix update

Network Security Services (NSS) is a set of libraries designed to support the cross-platform development of security-enabled client and server applications.

Security Fix(es):

  • nss: Side channel attack on ECDSA signature generation (CVE-2020-6829)

  • nss: P-384 and P-521 implementation uses a side-channel vulnerable modular inversion function (CVE-2020-12400)

  • nss: CHACHA20-POLY1305 decryption with undersized tag leads to out-of-bounds read (CVE-2020-12403)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • Support key wrap/unwrap with RSA-OAEP (BZ#1896431)

  • 1536bit group from RFC3526 is allowed in FIPS mode when in policy DH-MIN is set to be lower than 1536 (BZ#1896432)

  • when NSS_SDB_USE_CACHE not set, after curl access https, dentry increase but never released - consider alternative algorithm for benchmarking ACCESS call in sdb_measureAccess [Rocky Linux-8] (BZ#1896933)

  • Policy should allow overriding library defaults (BZ#1898702)

  • KDF-self-tests-induced changes for nss in Rocky Linux 8.4 (BZ#1898953)

  • nss: non-blocksize requests to IKEv1 KDF returns bogus output (BZ#1904408)

Record
RLSA-2021:0538
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-12403 9.1

A flaw was found in the way CHACHA20-POLY1305 was implemented in NSS in versions before 3.55. When using multi-part Chacha20, it could cause out-of-bounds reads. This issue was fixed by explicitly disabling multi-part ChaCha20 (which was not functioning correctly) and strictly enforcing tag length. The highest threat from this vulnerability is to confidentiality and system availability.

Record
UBUNTU-CVE-2020-12403
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVMGASA-2020-0318 No score

Updated firefox packages fix security vulnerability

WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is often transmitted to the peer, which allows bypassing ASLR (CVE-2020-6514).

Crafted media files could lead to a race in texture caches, resulting in a use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture, memory corruption, and a potentially exploitable crash (CVE-2020-6463).

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script (CVE-2020-15652).

Mozilla developers Jason Kratzer and Luke Wagner reported memory safety bugs present in Firefox 78 and Firefox ESR 68.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2020-15659).

Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-6829).

A side channel flaw was found in the way P-384 and P-521 curses are used in generation EDSA signatures, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12400).

Using the EM side-channel, it is possible to extract the position of zero and non-zero wNAF digits while nss-certutil tool performs scalar multiplication during the ECDSA signature generation, leaking partial information about the ECDSA nonce. Given a small number of ECDSA signatures, this information can be used to steal the private key. The highest threat from this vulnerability is to data confidentiality (CVE-2020-12401).

Multi-part ChaCha20 was not functioning correctly and tag length was not strictly enforced (CVE-2020-12403).

Record
MGASA-2020-0318
Updated
2026-11-02
OSVopenSUSE-SU-2024:11058-1 No score

libfreebl3-3.69.1-1.2 on GA media

These are all security issues fixed in the libfreebl3-3.69.1-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11058-1
Updated
2026-11-02
OSVSUSE-RU-2021:14818-1 No score

Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues:

mozilla-nspr was updated to version 4.32:

  • implement new socket option PR_SockOpt_DontFrag
  • support larger DNS records by increasing the default buffer size for DNS queries
  • Lock access to PRCallOnceType members in PR_CallOnce* for thread safety bmo#1686138
  • PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get information about the operating system build version.

Mozilla NSS was updated to version 3.68:

  • bmo#1713562 - Fix test leak.
  • bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  • bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  • bmo#1712883 - DTLS 1.3 draft-43.
  • bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  • bmo#1713562 - Validate ECH public names.
  • bmo#1717610 - Add function to get seconds from epoch from pkix::Time.

update to NSS 3.67

  • bmo#1683710 - Add a means to disable ALPN.
  • bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  • bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  • bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  • bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.

update to NSS 3.66

  • bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  • bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  • bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  • bmo#1707097 - Add Certum Trusted Root CA to NSS.
  • bmo#1707097 - Add Certum EC-384 CA to NSS.
  • bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  • bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  • bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  • bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  • bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  • bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  • bmo#1709291 - Add VerifyCodeSigningCertificateChain.

update to NSS 3.65

  • bmo#1709654 - Update for NetBSD configuration.
  • bmo#1709750 - Disable HPKE test when fuzzing.
  • bmo#1566124 - Optimize AES-GCM for ppc64le.
  • bmo#1699021 - Add AES-256-GCM to HPKE.
  • bmo#1698419 - ECH -10 updates.
  • bmo#1692930 - Update HPKE to final version.
  • bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  • bmo#1703936 - New coverity/cpp scanner errors.
  • bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  • bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  • bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.

update to NSS 3.64

  • bmo#1705286 - Properly detect mips64.
  • bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and disable_crypto_vsx.
  • bmo#1698320 - replace __builtin_cpu_supports('vsx') with ppc_crypto_support() for clang.
  • bmo#1613235 - Add POWER ChaCha20 stream cipher vector acceleration.

Fixed in 3.63

  • bmo#1697380 - Make a clang-format run on top of helpful contributions.
  • bmo#1683520 - ECCKiila P384, change syntax of nested structs initialization to prevent build isses with GCC 4.8.
  • bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual scalar multiplication.
  • bmo#1683520 - ECCKiila P521, change syntax of nested structs initialization to prevent build isses with GCC 4.8.
  • bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual scalar multiplication.
  • bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  • bmo#1694214 - tstclnt can't enable middlebox compat mode.
  • bmo#1694392 - NSS does not work with PKCS #11 modules not supporting profiles.
  • bmo#1685880 - Minor fix to prevent unused variable on early return.
  • bmo#1685880 - Fix for the gcc compiler version 7 to support setenv with nss build.
  • bmo#1693217 - Increase nssckbi.h version number for March 2021 batch of root CA changes, CA list version 2.48.
  • bmo#1692094 - Set…
Record
SUSE-RU-2021:14818-1
Updated
2026-11-02
OSVSUSE-RU-2021:3115-1 No score

Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues:

mozilla-nspr was updated to version 4.32:

  • implement new socket option PR_SockOpt_DontFrag
  • support larger DNS records by increasing the default buffer size for DNS queries
  • Lock access to PRCallOnceType members in PR_CallOnce* for thread safety bmo#1686138
  • PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get information about the operating system build version.

Mozilla NSS was updated to version 3.68:

  • bmo#1713562 - Fix test leak.
  • bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  • bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  • bmo#1712883 - DTLS 1.3 draft-43.
  • bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  • bmo#1713562 - Validate ECH public names.
  • bmo#1717610 - Add function to get seconds from epoch from pkix::Time.

update to NSS 3.67

  • bmo#1683710 - Add a means to disable ALPN.
  • bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  • bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  • bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  • bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.

update to NSS 3.66

  • bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  • bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  • bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  • bmo#1707097 - Add Certum Trusted Root CA to NSS.
  • bmo#1707097 - Add Certum EC-384 CA to NSS.
  • bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  • bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  • bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  • bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  • bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  • bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  • bmo#1709291 - Add VerifyCodeSigningCertificateChain.

update to NSS 3.65

  • bmo#1709654 - Update for NetBSD configuration.
  • bmo#1709750 - Disable HPKE test when fuzzing.
  • bmo#1566124 - Optimize AES-GCM for ppc64le.
  • bmo#1699021 - Add AES-256-GCM to HPKE.
  • bmo#1698419 - ECH -10 updates.
  • bmo#1692930 - Update HPKE to final version.
  • bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  • bmo#1703936 - New coverity/cpp scanner errors.
  • bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  • bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  • bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.

update to NSS 3.64

  • bmo#1705286 - Properly detect mips64.
  • bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and disable_crypto_vsx.
  • bmo#1698320 - replace __builtin_cpu_supports('vsx') with ppc_crypto_support() for clang.
  • bmo#1613235 - Add POWER ChaCha20 stream cipher vector acceleration.

Fixed in 3.63

  • bmo#1697380 - Make a clang-format run on top of helpful contributions.
  • bmo#1683520 - ECCKiila P384, change syntax of nested structs initialization to prevent build isses with GCC 4.8.
  • bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual scalar multiplication.
  • bmo#1683520 - ECCKiila P521, change syntax of nested structs initialization to prevent build isses with GCC 4.8.
  • bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual scalar multiplication.
  • bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  • bmo#1694214 - tstclnt can't enable middlebox compat mode.
  • bmo#1694392 - NSS does not work with PKCS #11 modules not supporting profiles.
  • bmo#1685880 - Minor fix to prevent unused variable on early return.
  • bmo#1685880 - Fix for the gcc compiler version 7 to support setenv with nss build.
  • bmo#1693217 - Increase nssckbi.h version number for March 2021 batch of root CA changes, CA list version 2.48.
  • bmo#1692094 - Set…
Record
SUSE-RU-2021:3115-1
Updated
2026-11-02
OSVSUSE-RU-2021:3115-2 No score

Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues:

mozilla-nspr was updated to version 4.32:

  • implement new socket option PR_SockOpt_DontFrag
  • support larger DNS records by increasing the default buffer size for DNS queries
  • Lock access to PRCallOnceType members in PR_CallOnce* for thread safety bmo#1686138
  • PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get information about the operating system build version.

Mozilla NSS was updated to version 3.68:

  • bmo#1713562 - Fix test leak.
  • bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  • bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  • bmo#1712883 - DTLS 1.3 draft-43.
  • bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  • bmo#1713562 - Validate ECH public names.
  • bmo#1717610 - Add function to get seconds from epoch from pkix::Time.

update to NSS 3.67

  • bmo#1683710 - Add a means to disable ALPN.
  • bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  • bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  • bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  • bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.

update to NSS 3.66

  • bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  • bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  • bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  • bmo#1707097 - Add Certum Trusted Root CA to NSS.
  • bmo#1707097 - Add Certum EC-384 CA to NSS.
  • bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  • bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  • bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  • bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  • bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  • bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  • bmo#1709291 - Add VerifyCodeSigningCertificateChain.

update to NSS 3.65

  • bmo#1709654 - Update for NetBSD configuration.
  • bmo#1709750 - Disable HPKE test when fuzzing.
  • bmo#1566124 - Optimize AES-GCM for ppc64le.
  • bmo#1699021 - Add AES-256-GCM to HPKE.
  • bmo#1698419 - ECH -10 updates.
  • bmo#1692930 - Update HPKE to final version.
  • bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  • bmo#1703936 - New coverity/cpp scanner errors.
  • bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  • bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  • bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.

update to NSS 3.64

  • bmo#1705286 - Properly detect mips64.
  • bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and disable_crypto_vsx.
  • bmo#1698320 - replace __builtin_cpu_supports('vsx') with ppc_crypto_support() for clang.
  • bmo#1613235 - Add POWER ChaCha20 stream cipher vector acceleration.

Fixed in 3.63

  • bmo#1697380 - Make a clang-format run on top of helpful contributions.
  • bmo#1683520 - ECCKiila P384, change syntax of nested structs initialization to prevent build isses with GCC 4.8.
  • bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual scalar multiplication.
  • bmo#1683520 - ECCKiila P521, change syntax of nested structs initialization to prevent build isses with GCC 4.8.
  • bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual scalar multiplication.
  • bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  • bmo#1694214 - tstclnt can't enable middlebox compat mode.
  • bmo#1694392 - NSS does not work with PKCS #11 modules not supporting profiles.
  • bmo#1685880 - Minor fix to prevent unused variable on early return.
  • bmo#1685880 - Fix for the gcc compiler version 7 to support setenv with nss build.
  • bmo#1693217 - Increase nssckbi.h version number for March 2021 batch of root CA changes, CA list version 2.48.
  • bmo#1692094 - Set…
Record
SUSE-RU-2021:3115-2
Updated
2026-11-02
OSVSUSE-RU-2021:3116-1 No score

Recommended update for mozilla-nspr, mozilla-nss

This update for mozilla-nspr fixes the following issues:

mozilla-nspr was updated to version 4.32:

  • implement new socket option PR_SockOpt_DontFrag
  • support larger DNS records by increasing the default buffer size for DNS queries
  • Lock access to PRCallOnceType members in PR_CallOnce* for thread safety bmo#1686138
  • PR_GetSystemInfo supports a new flag PR_SI_RELEASE_BUILD to get information about the operating system build version.

Mozilla NSS was updated to version 3.68:

  • bmo#1713562 - Fix test leak.
  • bmo#1717452 - NSS 3.68 should depend on NSPR 4.32.
  • bmo#1693206 - Implement PKCS8 export of ECDSA keys.
  • bmo#1712883 - DTLS 1.3 draft-43.
  • bmo#1655493 - Support SHA2 HW acceleration using Intel SHA Extension.
  • bmo#1713562 - Validate ECH public names.
  • bmo#1717610 - Add function to get seconds from epoch from pkix::Time.

update to NSS 3.67

  • bmo#1683710 - Add a means to disable ALPN.
  • bmo#1715720 - Fix nssckbi version number in NSS 3.67 (was supposed to be incremented in 3.66).
  • bmo#1714719 - Set NSS_USE_64 on riscv64 target when using GYP/Ninja.
  • bmo#1566124 - Fix counter increase in ppc-gcm-wrap.c.
  • bmo#1566124 - Fix AES_GCM mode on ppc64le for messages of length more than 255-byte.

update to NSS 3.66

  • bmo#1710716 - Remove Expired Sonera Class2 CA from NSS.
  • bmo#1710716 - Remove Expired Root Certificates from NSS - QuoVadis Root Certification Authority.
  • bmo#1708307 - Remove Trustis FPS Root CA from NSS.
  • bmo#1707097 - Add Certum Trusted Root CA to NSS.
  • bmo#1707097 - Add Certum EC-384 CA to NSS.
  • bmo#1703942 - Add ANF Secure Server Root CA to NSS.
  • bmo#1697071 - Add GLOBALTRUST 2020 root cert to NSS.
  • bmo#1712184 - NSS tools manpages need to be updated to reflect that sqlite is the default database.
  • bmo#1712230 - Don't build ppc-gcm.s with clang integrated assembler.
  • bmo#1712211 - Strict prototype error when trying to compile nss code that includes blapi.h.
  • bmo#1710773 - NSS needs FIPS 180-3 FIPS indicators.
  • bmo#1709291 - Add VerifyCodeSigningCertificateChain.

update to NSS 3.65

  • bmo#1709654 - Update for NetBSD configuration.
  • bmo#1709750 - Disable HPKE test when fuzzing.
  • bmo#1566124 - Optimize AES-GCM for ppc64le.
  • bmo#1699021 - Add AES-256-GCM to HPKE.
  • bmo#1698419 - ECH -10 updates.
  • bmo#1692930 - Update HPKE to final version.
  • bmo#1707130 - NSS should use modern algorithms in PKCS#12 files by default.
  • bmo#1703936 - New coverity/cpp scanner errors.
  • bmo#1697303 - NSS needs to update it's csp clearing to FIPS 180-3 standards.
  • bmo#1702663 - Need to support RSA PSS with Hashing PKCS #11 Mechanisms.
  • bmo#1705119 - Deadlock when using GCM and non-thread safe tokens.

update to NSS 3.64

  • bmo#1705286 - Properly detect mips64.
  • bmo#1687164 - Introduce NSS_DISABLE_CRYPTO_VSX and disable_crypto_vsx.
  • bmo#1698320 - replace __builtin_cpu_supports('vsx') with ppc_crypto_support() for clang.
  • bmo#1613235 - Add POWER ChaCha20 stream cipher vector acceleration.

Fixed in 3.63

  • bmo#1697380 - Make a clang-format run on top of helpful contributions.
  • bmo#1683520 - ECCKiila P384, change syntax of nested structs initialization to prevent build isses with GCC 4.8.
  • bmo#1683520 - [lib/freebl/ecl] P-384: allow zero scalars in dual scalar multiplication.
  • bmo#1683520 - ECCKiila P521, change syntax of nested structs initialization to prevent build isses with GCC 4.8.
  • bmo#1683520 - [lib/freebl/ecl] P-521: allow zero scalars in dual scalar multiplication.
  • bmo#1696800 - HACL* update March 2021 - c95ab70fcb2bc21025d8845281bc4bc8987ca683.
  • bmo#1694214 - tstclnt can't enable middlebox compat mode.
  • bmo#1694392 - NSS does not work with PKCS #11 modules not supporting profiles.
  • bmo#1685880 - Minor fix to prevent unused variable on early return.
  • bmo#1685880 - Fix for the gcc compiler version 7 to support setenv with nss build.
  • bmo#1693217 - Increase nssckbi.h version number for March 2021 batch of root CA changes, CA list version 2.48.
  • bmo#1692094 - Set…
Record
SUSE-RU-2021:3116-1
Updated
2026-11-02
OSVUSN-4476-1 No score

nss vulnerability

It was discovered that NSS incorrectly handled some inputs. An attacker could possibly use this issue to expose sensitive information.

Record
USN-4476-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nss
Alpine:v3.12
 before 3.55-r0
3.55-r0
nss
Alpine:v3.13
 before 3.55-r0
3.55-r0
nss
Alpine:v3.14
 before 3.55-r0
3.55-r0
nss
Alpine:v3.15
 before 3.55-r0
3.55-r0
nss
Alpine:v3.16
 before 3.55-r0
3.55-r0
nss
Alpine:v3.17
 before 3.55-r0
3.55-r0
nss
Alpine:v3.18
 before 3.55-r0
3.55-r0
nss
Alpine:v3.19
 before 3.55-r0
3.55-r0
nss
Alpine:v3.20
 before 3.55-r0
3.55-r0
nss
Alpine:v3.21
 before 3.55-r0
3.55-r0
Show 214 moreShow less
Affected packages
PackageAffectedFixed
nss
Alpine:v3.22
 before 3.55-r0
3.55-r0
nss
Alpine:v3.23
 before 3.55-r0
3.55-r0
nss
Alpine:v3.24
 before 3.55-r0
3.55-r0
nss
Azure Linux:2
 before 3.44-10
3.44-10
nss
Debian:12
 before 2:3.55-1
2:3.55-1
nss
Debian:13
 before 2:3.55-1
2:3.55-1
nss
Debian:14
 before 2:3.55-1
2:3.55-1
nss
Debian:9
 before 2:3.26.2-1.1+deb9u2, plus listed versions
2:3.26.2-1.12:3.26.2-1.1+deb9u1
2:3.26.2-1.1+deb9u2
nss
Debian:10
 before 2:3.42.1-1+deb10u6, plus listed versions
2:3.42.1-12:3.42.1-1+deb10u12:3.42.1-1+deb10u22:3.42.1-1+deb10u32:3.42.1-1+deb10u42:3.42.1-1+deb10u5
2:3.42.1-1+deb10u6
firefox
Mageia:7
 before 68.11.0-1.mga7
68.11.0-1.mga7
firefox-l10n
Mageia:7
 before 68.11.0-1.mga7
68.11.0-1.mga7
nspr
Mageia:7
 before 4.27-1.mga7
4.27-1.mga7
nss
Mageia:7
 before 3.52.1-1.2.mga7
3.52.1-1.2.mga7
nss
openEuler:20.03-LTS
 before 3.54.0-6.oe1
3.54.0-6.oe1
nss
openEuler:20.03-LTS-SP1
 before 3.54.0-6.oe1
3.54.0-6.oe1
nspr
Red Hat:enterprise_linux:7::client
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-sysinit
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-tools
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-util
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nspr-devel
Red Hat:enterprise_linux:7::client
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-pkcs11-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-util-devel
Red Hat:enterprise_linux:7::client
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nspr-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-devel
Red Hat:enterprise_linux:7::computenode
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-pkcs11-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-util-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-devel
Red Hat:enterprise_linux:7::computenode
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nspr
Red Hat:enterprise_linux:7::server
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-devel
Red Hat:enterprise_linux:7::server
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-sysinit
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-tools
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-util
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-pkcs11-devel
Red Hat:enterprise_linux:7::server
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nspr
Red Hat:enterprise_linux:7::workstation
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nspr-devel
Red Hat:enterprise_linux:7::workstation
 before 0:4.25.0-2.el7_9
0:4.25.0-2.el7_9
nss
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-softokn
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-softokn-freebl-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-6.el7_9
0:3.53.1-6.el7_9
nss-sysinit
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-tools
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss-util
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-util-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-1.el7_9
0:3.53.1-1.el7_9
nss-pkcs11-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.53.1-3.el7_9
0:3.53.1-3.el7_9
nss
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-softokn
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-softokn-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-softokn-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-softokn-freebl
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-softokn-freebl-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-softokn-freebl-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-sysinit
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-sysinit-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-tools
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-util
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-util-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-util-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
nss-softokn
Red Hat:rhel_aus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-debuginfo
Red Hat:rhel_aus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-devel
Red Hat:rhel_aus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-freebl
Red Hat:rhel_aus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-freebl-devel
Red Hat:rhel_aus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn
Red Hat:rhel_e4s:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-debuginfo
Red Hat:rhel_e4s:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-devel
Red Hat:rhel_e4s:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-freebl
Red Hat:rhel_e4s:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-freebl-devel
Red Hat:rhel_e4s:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn
Red Hat:rhel_tus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-debuginfo
Red Hat:rhel_tus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-devel
Red Hat:rhel_tus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-freebl
Red Hat:rhel_tus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss-softokn-freebl-devel
Red Hat:rhel_tus:7.4::server
 before 0:3.28.3-10.el7_4
0:3.28.3-10.el7_4
nss
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-debuginfo
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-softokn
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss-softokn-debuginfo
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss-softokn-freebl
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss-sysinit
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-tools
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-devel
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-pkcs11-devel
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-softokn-devel
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss-softokn-freebl-devel
Red Hat:rhel_eus:7.6::computenode
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-debuginfo
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-devel
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-softokn
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss-softokn-debuginfo
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss-softokn-devel
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss-softokn-freebl
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss-softokn-freebl-devel
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-7.el7_6
0:3.36.0-7.el7_6
nss-sysinit
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-tools
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-pkcs11-devel
Red Hat:rhel_eus:7.6::server
 before 0:3.36.0-9.el7_6
0:3.36.0-9.el7_6
nss-softokn
Red Hat:rhel_eus:7.7::computenode
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss-softokn-debuginfo
Red Hat:rhel_eus:7.7::computenode
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss-softokn-freebl
Red Hat:rhel_eus:7.7::computenode
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss-softokn-devel
Red Hat:rhel_eus:7.7::computenode
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss-softokn-freebl-devel
Red Hat:rhel_eus:7.7::computenode
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss-softokn
Red Hat:rhel_eus:7.7::server
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss-softokn-debuginfo
Red Hat:rhel_eus:7.7::server
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss-softokn-devel
Red Hat:rhel_eus:7.7::server
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss-softokn-freebl
Red Hat:rhel_eus:7.7::server
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss-softokn-freebl-devel
Red Hat:rhel_eus:7.7::server
 before 0:3.44.0-9.el7_7
0:3.44.0-9.el7_7
nss
Rocky Linux:8
 before 0:3.53.1-17.el8_3
0:3.53.1-17.el8_3
mozilla-nspr
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 4.32-33.6.1
4.32-33.6.1
mozilla-nss
SUSE:Linux Enterprise Point of Sale 11 SP3
 before 3.68-47.16.1
3.68-47.16.1
mozilla-nspr
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 4.32-33.6.1
4.32-33.6.1
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 3.68-47.16.1
3.68-47.16.1
mozilla-nspr
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nss
SUSE:Linux Enterprise Module for Server Applications 15 SP2
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nss
SUSE:Linux Enterprise Module for Server Applications 15 SP3
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise High Performance Computing 15-ESPOS
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise High Performance Computing 15-LTSS
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise Server 15-LTSS
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise Server 15-LTSS
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise Server 15 SP1-BCL
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise Server 15 SP1-LTSS
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise Server for SAP Applications 15
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 15
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 15 SP1
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Manager Proxy 4.0
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Manager Proxy 4.0
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Manager Retail Branch Server 4.0
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Manager Retail Branch Server 4.0
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Manager Server 4.0
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Manager Server 4.0
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise Micro 5.0
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise Micro 5.0
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Enterprise Storage 6
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Enterprise Storage 6
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:Linux Enterprise Micro 5.1
 before 4.32-3.20.1
4.32-3.20.1
mozilla-nss
SUSE:Linux Enterprise Micro 5.1
 before 3.68-3.56.1
3.68-3.56.1
mozilla-nspr
SUSE:HPE Helion OpenStack 8
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:HPE Helion OpenStack 8
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:OpenStack Cloud 8
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:OpenStack Cloud 8
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:OpenStack Cloud 9
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:OpenStack Cloud 9
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:OpenStack Cloud Crowbar 8
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:OpenStack Cloud Crowbar 8
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:OpenStack Cloud Crowbar 9
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:OpenStack Cloud Crowbar 9
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:Linux Enterprise Server 12 SP3-LTSS
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:Linux Enterprise Server 12 SP3-BCL
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:Linux Enterprise Server 12 SP4-LTSS
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:Linux Enterprise Server 12 SP5
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:Linux Enterprise Server 12 SP5
 before 3.68-58.54.1
3.68-58.54.1
mozilla-nspr
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 4.32-19.18.1
4.32-19.18.1
mozilla-nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 3.68-58.54.1
3.68-58.54.1
nss
Ubuntu:Pro:14.04:LTS
 before 2:3.28.4-0ubuntu0.14.04.5+esm8, plus listed versions
2:3.15.1-1ubuntu12:3.15.2-12:3.15.3-12:3.15.3.1-12:3.15.3.1-1.1
Show 30 moreShow less
2:3.15.3.1-1.1ubuntu12:3.15.4-1ubuntu32:3.15.4-1ubuntu42:3.15.4-1ubuntu52:3.15.4-1ubuntu62:3.15.4-1ubuntu72:3.15.4-1ubuntu7.12:3.17-0ubuntu0.14.04.12:3.17.1-0ubuntu0.14.04.12:3.17.1-0ubuntu0.14.04.22:3.17.4-0ubuntu0.14.04.12:3.19.2-0ubuntu0.14.04.12:3.19.2.1-0ubuntu0.14.04.12:3.19.2.1-0ubuntu0.14.04.22:3.21-0ubuntu0.14.04.12:3.21-0ubuntu0.14.04.22:3.23-0ubuntu0.14.04.12:3.26.2-0ubuntu0.14.04.32:3.28.4-0ubuntu0.14.04.12:3.28.4-0ubuntu0.14.04.22:3.28.4-0ubuntu0.14.04.32:3.28.4-0ubuntu0.14.04.42:3.28.4-0ubuntu0.14.04.52:3.28.4-0ubuntu0.14.04.5+esm12:3.28.4-0ubuntu0.14.04.5+esm22:3.28.4-0ubuntu0.14.04.5+esm32:3.28.4-0ubuntu0.14.04.5+esm42:3.28.4-0ubuntu0.14.04.5+esm52:3.28.4-0ubuntu0.14.04.5+esm62:3.28.4-0ubuntu0.14.04.5+esm7
2:3.28.4-0ubuntu0.14.04.5+esm8
nss
Ubuntu:16.04:LTS
 before 2:3.28.4-0ubuntu0.16.04.14, plus listed versions
2:3.19.2-1ubuntu12:3.19.2.1-0ubuntu12:3.21-1ubuntu22:3.21-1ubuntu32:3.21-1ubuntu4
Show 14 moreShow less
2:3.23-0ubuntu0.16.04.12:3.26.2-0ubuntu0.16.04.22:3.28.4-0ubuntu0.16.04.12:3.28.4-0ubuntu0.16.04.22:3.28.4-0ubuntu0.16.04.32:3.28.4-0ubuntu0.16.04.42:3.28.4-0ubuntu0.16.04.52:3.28.4-0ubuntu0.16.04.62:3.28.4-0ubuntu0.16.04.82:3.28.4-0ubuntu0.16.04.92:3.28.4-0ubuntu0.16.04.102:3.28.4-0ubuntu0.16.04.112:3.28.4-0ubuntu0.16.04.122:3.28.4-0ubuntu0.16.04.13
2:3.28.4-0ubuntu0.16.04.14
nss
Ubuntu:18.04:LTS
 before 2:3.35-2ubuntu2.12, plus listed versions
2:3.32-1ubuntu32:3.34-1ubuntu12:3.35-2ubuntu22:3.35-2ubuntu2.12:3.35-2ubuntu2.2
Show 7 moreShow less
2:3.35-2ubuntu2.32:3.35-2ubuntu2.52:3.35-2ubuntu2.62:3.35-2ubuntu2.72:3.35-2ubuntu2.82:3.35-2ubuntu2.92:3.35-2ubuntu2.11
2:3.35-2ubuntu2.12
nss
Ubuntu:20.04:LTS
 before 2:3.49.1-1ubuntu1.5, plus listed versions
2:3.45-1ubuntu22:3.47-1ubuntu12:3.47-1ubuntu22:3.48-1ubuntu12:3.49.1-1ubuntu12:3.49.1-1ubuntu1.12:3.49.1-1ubuntu1.22:3.49.1-1ubuntu1.4
2:3.49.1-1ubuntu1.5
mozilla-nss
openSUSE:Tumbleweed
 before 3.69.1-1.2
3.69.1-1.2

History

History
RecordedChangedSources
affectedOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12403 is a critical vulnerability (CVSS 9.1) in Mozilla Nss, published August 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 74th percentile. Fixed in nss 3.55-r0.

References

Show 108 moreShow less
This page doesn't list everything

Left out here: the rest of 4 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open