{"id":"CVE-2022-3479","aliases":["ALPINE-CVE-2022-3479","BELL-CVE-2022-3479","DEBIAN-CVE-2022-3479","EUVD-2022-42851","GHSA-6275-5f4x-m3m3","MGASA-2023-0018","OESA-2024-1211","OESA-2024-1212","OESA-2024-1213","OESA-2024-1214","SUSE-SU-2023:0118-1","SUSE-SU-2023:0119-1","SUSE-SU-2023:0130-1"],"status":"published","title":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a...","description":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00956,"percentile":0.61706,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-10-14T00:00:00Z","modified":"2026-11-03T07:30:37Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"nss","fixed_in":["3.85-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nss","fixed_in":["2:3.87-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nss","fixed_in":["2:3.87-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nss","fixed_in":["2:3.87-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"firefox","fixed_in":["102.15.0-5.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"firefox","fixed_in":["102.15.0-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"firefox","fixed_in":["102.15.0-5.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"firefox","fixed_in":["102.15.0-5.oe2203sp3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.85-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.87-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.87-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:3.87-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.7.0-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.7.0-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.87.0-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.0-5.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.0-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.0-5.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"102.15.0-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-58.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-58.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-58.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-58.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-58.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-58.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-58.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-58.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150400.3.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150400.3.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150400.3.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150400.3.23.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.79.3-150000.3.90.1"}]}],"bundled":2}],"products":[{"vendor":"mozilla","product":"network_security_services"},{"vendor":"mozilla","product":"nss"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1774654","tags":["x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2134331","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://security.gentoo.org/glsa/202212-05","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3479","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6275-5f4x-m3m3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-3479","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-3479","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3479","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0018.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31415","tags":["report"]},{"url":"https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/7D6OeqrEDcE","tags":["web"]},{"url":"https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_87.html","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2023-02/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YPGIG3RLJJT2HMZS76SNGJZMTWOTMFUX/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2023:0288","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1211","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1212","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1213","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1214","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230118-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204272","tags":["report"]},{"url":"https://bugzilla.suse.com/1207038","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3479","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230119-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230130-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3479","description":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.","status":"published","published":"2022-10-14T00:00:00Z","modified":"2024-11-20T16:21:14.279Z","updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42851","description":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.","status":"published","published":"2022-10-14T00:00:00Z","modified":"2024-11-20T16:21:14Z","updated_at":"2026-11-03T00:04:54.237682Z"}],"ghsa":[{"id":"GHSA-6275-5f4x-m3m3","title":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a...","description":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.","status":"published","published":"2022-10-14T19:00:22Z","modified":"2023-01-28T05:01:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:43:32.326963Z"}],"nvd":[{"id":"CVE-2022-3479","description":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.","status":"published","published":"2022-10-14T17:15:15.463Z","modified":"2026-06-17T04:59:36.273Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:07:29.52424Z"}],"osv":[{"id":"ALPINE-CVE-2022-3479","description":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.","status":"published","published":"2022-10-14T17:15:15.463Z","modified":"2026-11-03T07:30:37.642981903Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"BELL-CVE-2022-3479","title":"CVE-2022-3479 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:21:32.957374Z","modified":"2026-01-26T09:46:12.241857Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.151188Z"},{"id":"CVE-2022-3479","description":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.","status":"published","published":"2022-10-14T17:15:15.463Z","modified":"2026-04-16T04:30:24.464712738Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"OESA-2024-1211","title":"firefox security update","description":"Mozilla Firefox is a standalone web browser, designed for standards compliance and performance.  Its functionality can be enhanced via a plethora of extensions.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.(CVE-2022-3479)","status":"published","published":"2024-03-01T11:06:39Z","modified":"2026-08-18T01:18:16.330909221Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1212","title":"firefox security update","description":"Mozilla Firefox is a standalone web browser, designed for standards compliance and performance.  Its functionality can be enhanced via a plethora of extensions.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.(CVE-2022-3479)","status":"published","published":"2024-03-01T11:06:39Z","modified":"2026-08-18T01:18:16.19979837Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1213","title":"firefox security update","description":"Mozilla Firefox is a standalone web browser, designed for standards compliance and performance.  Its functionality can be enhanced via a plethora of extensions.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.(CVE-2022-3479)","status":"published","published":"2024-03-01T11:06:39Z","modified":"2026-08-18T01:18:16.348863908Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2024-1214","title":"firefox security update","description":"Mozilla Firefox is a standalone web browser, designed for standards compliance and performance.  Its functionality can be enhanced via a plethora of extensions.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.(CVE-2022-3479)","status":"published","published":"2024-03-01T11:06:39Z","modified":"2026-08-18T01:18:16.344727272Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"DEBIAN-CVE-2022-3479","description":"A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.","status":"published","published":"2022-10-14T17:15:15.463Z","modified":"2026-11-03T06:02:40.644396181Z","updated_at":"2026-11-03T06:43:43.638289Z"},{"id":"MGASA-2023-0018","title":"Updated firefox packages fix security vulnerability","description":"A vulnerability was found in NSS. The NSS client auth crashes without a user\ncertificate in the database, leading to a segmentation fault or crash\n(CVE-2022-3479).\n\nAn out of date library (libusrsctp) contained vulnerabilities that could\npotentially be exploited (CVE-2022-46871).\n\nBy confusing the browser, the fullscreen notification could have been delayed\nor suppressed, resulting in potential user confusion or spoofing attacks\n(CVE-2022-46877).\n\nDue to the Firefox GTK wrapper code's use of text/plain for drag data and GTK\ntreating all text/plain MIMEs containing file URLs as being dragged a website\ncould arbitrarily read a file via a call to DataTransfer.setData\n(CVE-2023-23598).\n\nNavigations were being allowed when dragging a URL from a cross-origin iframe\ninto the same tab which could lead to website spoofing attacks\n(CVE-2023-23601).\n\nA mishandled security check when creating a WebSocket in a WebWorker caused\nthe Content Security Policy connect-src header to be ignored. This could lead\nto connections to restricted origins from inside WebWorkers (CVE-2023-23602).\n\nRegular expressions used to filter out forbidden properties and values from\nstyle directives in calls to console.log weren't accounting for external URLs,\nallowing bypassing Content Security Policy via format directives. Data could\nthen be potentially exfiltrated from the browser (CVE-2023-23603).\n\nMozilla developers and the Mozilla Fuzzing Team reported memory safety bugs\npresent in Firefox ESR 102.6. Some of these bugs showed evidence of memory\ncorruption and we presume that with enough effort some of these could have\nbeen exploited to run arbitrary code (CVE-2023-23605).\n","status":"published","published":"2023-01-24T07:58:25Z","modified":"2026-04-16T04:41:03.328977839Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"SUSE-SU-2023:0118-1","title":"Security update for mozilla-nss","description":"This update for mozilla-nss fixes the following issues:\n\n- CVE-2022-3479: Fixed a potential crash that could be triggered when\n  a server requested a client authentication certificate, but the\n  client had no certificates stored (bsc#1204272).\n- Updated to version 3.79.3 (bsc#1207038):\n  - CVE-2022-23491: Removed trust for 3 root certificates from TrustCor.\n","status":"published","published":"2023-01-20T09:27:44Z","modified":"2025-05-02T04:32:48.443943Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0119-1","title":"Security update for mozilla-nss","description":"This update for mozilla-nss fixes the following issues:\n\n- CVE-2022-3479: Fixed a potential crash that could be triggered when\n  a server requested a client authentication certificate, but the\n  client had no certificates stored (bsc#1204272).\n- Updated to version 3.79.3 (bsc#1207038):\n  - CVE-2022-23491: Removed trust for 3 root certificates from TrustCor.\n","status":"published","published":"2023-01-20T09:28:13Z","modified":"2026-02-04T04:39:50.32984Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0130-1","title":"Security update for mozilla-nss","description":"This update for mozilla-nss fixes the following issues:\n\n- CVE-2022-3479: Fixed a potential crash that could be triggered when\n  a server requested a client authentication certificate, but the\n  client had no certificates stored (bsc#1204272).\n- Updated to version 3.79.3 (bsc#1207038):\n  - CVE-2022-23491: Removed trust for 3 root certificates from TrustCor.\n","status":"published","published":"2023-01-24T14:22:55Z","modified":"2026-02-04T04:31:00.233029Z","updated_at":"2026-11-02T15:53:51.853735Z"}]}}