Published: 06/02/2014 Updated: 31/07/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Mozilla Network Security Services (NSS) prior to 3.15.4, as used in Mozilla Firefox prior to 27.0, Firefox ESR 24.x prior to 24.3, Thunderbird prior to 24.3, SeaMonkey prior to 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote malicious users to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox
mozilla firefox esr
mozilla network security services
mozilla seamonkey
mozilla thunderbird
oracle enterprise manager ops center
oracle enterprise manager ops center 12.2.0
oracle enterprise manager ops center 12.2.1
oracle enterprise manager ops center 12.3.0
oracle vm server 3.2
fedoraproject fedora 19
fedoraproject fedora 20
opensuse opensuse 11.4
opensuse opensuse 12.3
opensuse opensuse 13.1
suse linux enterprise desktop 11
suse linux enterprise server 11
suse linux enterprise software development kit 11
debian debian linux 7.0
debian debian linux 8.0
canonical ubuntu linux 12.04
canonical ubuntu linux 12.10
canonical ubuntu linux 13.10

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Several security issues were fixed in Thunderbird ...

USN-2102-1 introduced a regression in Firefox ...

Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library: CVE-2013-1741 Runaway memset in certificate parsing on 64-bit computers leading to a crash by attempting to write 4Gb of nulls CVE-2013-5606 Certificate validation with the verifylog mode did not return validation errors, but instead ...

Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, use-after-frees, too-verbose error messages and missing permission checks may lead to the execution of arbitrary code, the bypass of security checks or information disclosure This update also addresses security ...

Mozilla Foundation Security Advisory 2014-12 NSS ticket handling issues Announced February 4, 2014 Reporter Brian Smith, Antoine Delignat-Lavaud, Karthikeyan Bhargavan Impact High Products Firefox, Firefox ESR, SeaMonkey, Th ...

It was found that NSS accepted weak Diffie-Hellman Key exchange (DHKE) parameters This could possibly lead to weak encryption being used in communication between the client and the server ...

CWE-326 https://bugzilla.mozilla.org/show_bug.cgi?id=934545 http://www.mozilla.org/security/announce/2014/mfsa2014-12.html http://www.ubuntu.com/usn/USN-2102-1 http://www.debian.org/security/2014/dsa-2858 http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html http://www.ubuntu.com/usn/USN-2119-1 http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html http://www.ubuntu.com/usn/USN-2102-2 http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://seclists.org/fulldisclosure/2014/Dec/23 http://www.debian.org/security/2014/dsa-2994 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.securityfocus.com/bid/65332 https://security.gentoo.org/glsa/201504-01 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html https://exchange.xforce.ibmcloud.com/vulnerabilities/90886 http://www.securitytracker.com/id/1029721 http://www.securitytracker.com/id/1029720 http://www.securitytracker.com/id/1029717 http://secunia.com/advisories/56922 http://secunia.com/advisories/56888 http://secunia.com/advisories/56858 http://hg.mozilla.org/projects/nss/rev/12c42006aed8 http://www.securityfocus.com/archive/1/534161/100/0/threaded https://nvd.nist.gov https://usn.ubuntu.com/2102-1/https://access.redhat.com/security/cve/cve-2014-1491

CVE-2014-1491

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect