CVE-2014-1498 The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service...
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SUSE linux enterprise desktop | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp3 | No fix listed |
| SUSE linux enterprise software development kit | = 11-sp3 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse project opensuse | = 11.4 | No fix listed |
| opensuse project opensuse | = 12.3 | No fix listed |
| mozilla seamonkey | < 2.25 | 2.25 |
| mozilla Firefox | < 28.0 | 28.0 |
References
- SUSE-SU-2014:0418 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0419 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0448 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0584 mailing-list third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com mailing-list third-party-advisory
- bugzilla.mozilla.org issue-tracking vendor-advisory
- GLSA-201504-01 third-party-advisory vendor-advisory