CVE-2014-1490 Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24,...
HighCVSS 9.3
EPSS 3.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nss(Debian:12) | < 2:3.15.4-1 | 2:3.15.4-1 |
| debian/nss(Debian:13) | < 2:3.15.4-1 | 2:3.15.4-1 |
| debian/nss(Debian:14) | < 2:3.15.4-1 | 2:3.15.4-1 |
| mozilla Firefox | < 24.3 | 24.3 |
| mozilla Firefox | < 27.0 | 27.0 |
| mozilla network security services | < 3.15.4 | 3.15.4 |
| mozilla seamonkey | < 2.24 | 2.24 |
| mozilla Thunderbird | < 24.3.0 | 24.3.0 |
| oracle enterprise manager ops center | < 12.1.4 | 12.1.4 |
| oracle enterprise manager ops center | = 12.2.0 | No fix listed |
| oracle enterprise manager ops center | = 12.2.1 | No fix listed |
| oracle enterprise manager ops center | = 12.3.0 | No fix listed |
| oracle vm server | = 3.2 | No fix listed |
| fedoraproject fedora | = 19 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp3 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.10 | No fix listed |
References
- Debian Security Tracker CVE-2014-1490 vendor-advisory
- kb.juniper.net third-party-advisory
- FEDORA-2014-2041 third-party-advisory vendor-advisory
- FEDORA-2014-2083 third-party-advisory vendor-advisory
- openSUSE-SU-2014:0212 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0213 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2014:0248 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0419 mailing-list third-party-advisory vendor-advisory
- 102876 broken-link vdb-entry
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list not-applicable
- 56706 third-party-advisory
- 56767 third-party-advisory
- 56787 third-party-advisory
- 56858 third-party-advisory
- 56888 third-party-advisory
- 56922 third-party-advisory
- DSA-2858 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- www.oracle.com third-party-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list not-applicable
- 65335 third-party-advisory vdb-entry
- 1029717 third-party-advisory vdb-entry
- 1029720 third-party-advisory vdb-entry
- 1029721 third-party-advisory vdb-entry
- USN-2102-1 third-party-advisory vendor-advisory
- USN-2102-2 third-party-advisory vendor-advisory
- USN-2119-1 third-party-advisory vendor-advisory
- www.vmware.com not-applicable
- 8pecxstudios.com broken-link url-repurposed
- bugzilla.mozilla.org issue-tracking patch vendor-advisory
- bugzilla.mozilla.org issue-tracking patch vendor-advisory
- mozilla-nss-cve20141490-code-exec(90885) third-party-advisory vdb-entry
- GLSA-201504-01 third-party-advisory vendor-advisory