Published: 06/02/2014 Updated: 14/02/2024

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Race condition in libssl in Mozilla Network Security Services (NSS) prior to 3.15.4, as used in Mozilla Firefox prior to 27.0, Firefox ESR 24.x prior to 24.3, Thunderbird prior to 24.3, SeaMonkey prior to 2.24, and other products, allows remote malicious users to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla network security services
mozilla seamonkey
mozilla firefox
mozilla firefox esr
mozilla thunderbird
oracle enterprise manager ops center 12.2.1
oracle enterprise manager ops center 12.3.0
oracle enterprise manager ops center 12.2.0
oracle vm server 3.2
oracle enterprise manager ops center
fedoraproject fedora 20
fedoraproject fedora 19
suse linux enterprise desktop 11
suse linux enterprise server 11
opensuse opensuse 12.3
suse linux enterprise software development kit 11
opensuse opensuse 11.4
opensuse opensuse 13.1
debian debian linux 7.0
canonical ubuntu linux 13.10
canonical ubuntu linux 12.10
canonical ubuntu linux 12.04

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Several security issues were fixed in Thunderbird ...

USN-2102-1 introduced a regression in Firefox ...

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, too-verbose error messages and missing permission checks may lead to the execution of arbitrary code, the bypass of security checks or information disclosure This update also addresses security ...

Mozilla Foundation Security Advisory 2014-12 NSS ticket handling issues Announced February 4, 2014 Reporter Brian Smith, Antoine Delignat-Lavaud, Karthikeyan Bhargavan Impact High Products Firefox, Firefox ESR, SeaMonkey, Th ...

A race condition was found in the way NSS implemented session ticket handling as specified by RFC 5077 An attacker could use this flaw to crash an application using NSS or, in rare cases, execute arbitrary code with the privileges of the user running that application ...

CWE-362 https://bugzilla.mozilla.org/show_bug.cgi?id=930874 https://bugzilla.mozilla.org/show_bug.cgi?id=930857 http://www.mozilla.org/security/announce/2014/mfsa2014-12.html https://8pecxstudios.com/?page_id=44080 http://secunia.com/advisories/56706 http://www.ubuntu.com/usn/USN-2102-1 http://www.debian.org/security/2014/dsa-2858 http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html http://www.ubuntu.com/usn/USN-2119-1 http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html http://www.ubuntu.com/usn/USN-2102-2 http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://seclists.org/fulldisclosure/2014/Dec/23 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/65335 https://security.gentoo.org/glsa/201504-01 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html https://exchange.xforce.ibmcloud.com/vulnerabilities/90885 http://www.securitytracker.com/id/1029721 http://www.securitytracker.com/id/1029720 http://www.securitytracker.com/id/1029717 http://secunia.com/advisories/56922 http://secunia.com/advisories/56888 http://secunia.com/advisories/56858 http://secunia.com/advisories/56787 http://secunia.com/advisories/56767 http://osvdb.org/102876 http://www.securityfocus.com/archive/1/534161/100/0/threaded https://nvd.nist.gov https://usn.ubuntu.com/2102-1/https://access.redhat.com/security/cve/cve-2014-1490

CVE-2014-1490

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect