CVE-2014-1568 Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x befor...
HighCVSS 7.5
EPSS 16.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nss(Debian:12) | < 2:3.17.1-1 | 2:3.17.1-1 |
| debian/nss(Debian:13) | < 2:3.17.1-1 | 2:3.17.1-1 |
| debian/nss(Debian:14) | < 2:3.17.1-1 | 2:3.17.1-1 |
| Google Chrome | <= 37.0.2062.120 | No fix listed |
| Google Chrome | <= 37.0.2062.103 | No fix listed |
| Google Chrome | = 37.0.2062.0 | No fix listed |
| Google Chrome | = 37.0.2062.3 | No fix listed |
| Google Chrome | = 37.0.2062.20 | No fix listed |
| Google Chrome | = 37.0.2062.100 | No fix listed |
| Google Chrome | = 37.0.2062.102 | No fix listed |
| mozilla Firefox | <= 32.0 | No fix listed |
| mozilla Firefox | = 31.0 | No fix listed |
| mozilla Firefox | = 31.1.0 | No fix listed |
| mozilla Firefox | = 32.0.1 | No fix listed |
| mozilla Firefox | = 32.0.2 | No fix listed |
| mozilla firefox esr | = 24.8.0 | No fix listed |
| mozilla network security services | <= 3.16.2.0 | No fix listed |
| mozilla network security services | = 3.2 | No fix listed |
| mozilla network security services | = 3.2.1 | No fix listed |
| mozilla network security services | = 3.3 | No fix listed |
| mozilla network security services | = 3.3.1 | No fix listed |
| mozilla network security services | = 3.3.2 | No fix listed |
| mozilla network security services | = 3.4 | No fix listed |
| mozilla network security services | = 3.4.1 | No fix listed |
| mozilla network security services | = 3.4.2 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla network security services | = 3.5 | No fix listed |
| mozilla network security services | = 3.6 | No fix listed |
| mozilla network security services | = 3.6.1 | No fix listed |
| mozilla network security services | = 3.7 | No fix listed |
| mozilla network security services | = 3.7.1 | No fix listed |
| mozilla network security services | = 3.7.2 | No fix listed |
| mozilla network security services | = 3.7.3 | No fix listed |
| mozilla network security services | = 3.7.5 | No fix listed |
| mozilla network security services | = 3.7.7 | No fix listed |
| mozilla network security services | = 3.8 | No fix listed |
| mozilla network security services | = 3.9 | No fix listed |
| mozilla network security services | = 3.11.2 | No fix listed |
| mozilla network security services | = 3.11.3 | No fix listed |
| mozilla network security services | = 3.11.4 | No fix listed |
| mozilla network security services | = 3.11.5 | No fix listed |
| mozilla network security services | = 3.12 | No fix listed |
| mozilla network security services | = 3.12.1 | No fix listed |
| mozilla network security services | = 3.12.2 | No fix listed |
| mozilla network security services | = 3.12.3 | No fix listed |
| mozilla network security services | = 3.12.3.1 | No fix listed |
| mozilla network security services | = 3.12.3.2 | No fix listed |
| mozilla network security services | = 3.12.4 | No fix listed |
| mozilla network security services | = 3.12.5 | No fix listed |
| mozilla network security services | = 3.12.6 | No fix listed |
| mozilla network security services | = 3.12.7 | No fix listed |
| mozilla network security services | = 3.12.8 | No fix listed |
| mozilla network security services | = 3.12.9 | No fix listed |
| mozilla network security services | = 3.12.10 | No fix listed |
| mozilla network security services | = 3.12.11 | No fix listed |
| mozilla network security services | = 3.14 | No fix listed |
| mozilla network security services | = 3.14.1 | No fix listed |
| mozilla network security services | = 3.14.2 | No fix listed |
| mozilla network security services | = 3.14.3 | No fix listed |
| mozilla network security services | = 3.14.4 | No fix listed |
| mozilla network security services | = 3.14.5 | No fix listed |
| mozilla network security services | = 3.15 | No fix listed |
| mozilla network security services | = 3.15.1 | No fix listed |
| mozilla network security services | = 3.15.2 | No fix listed |
| mozilla network security services | = 3.15.3 | No fix listed |
| mozilla network security services | = 3.15.3.1 | No fix listed |
| mozilla network security services | = 3.15.4 | No fix listed |
| mozilla network security services | = 3.15.5 | No fix listed |
| mozilla network security services | = 3.16 | No fix listed |
| mozilla network security services | = 3.16.1 | No fix listed |
| mozilla network security services | = 3.16.3 | No fix listed |
| mozilla network security services | = 3.16.4 | No fix listed |
| mozilla seamonkey | All versions | No fix listed |
| mozilla seamonkey | <= 2.29 | No fix listed |
| mozilla seamonkey | = 1.0 | No fix listed |
| mozilla seamonkey | = 1.0-alpha | No fix listed |
| mozilla seamonkey | = 1.0-beta | No fix listed |
| mozilla seamonkey | = 1.0.1 | No fix listed |
| mozilla seamonkey | = 1.0.2 | No fix listed |
| mozilla seamonkey | = 1.0.3 | No fix listed |
| mozilla seamonkey | = 1.0.4 | No fix listed |
| mozilla seamonkey | = 1.0.5 | No fix listed |
| mozilla seamonkey | = 1.0.6 | No fix listed |
| mozilla seamonkey | = 1.0.7 | No fix listed |
| mozilla seamonkey | = 1.0.8 | No fix listed |
| mozilla seamonkey | = 1.0.9 | No fix listed |
| mozilla seamonkey | = 1.1 | No fix listed |
| mozilla seamonkey | = 1.1-alpha | No fix listed |
| mozilla seamonkey | = 1.1-beta | No fix listed |
| mozilla seamonkey | = 1.1.1 | No fix listed |
| mozilla seamonkey | = 1.1.2 | No fix listed |
| mozilla seamonkey | = 1.1.3 | No fix listed |
| mozilla seamonkey | = 1.1.4 | No fix listed |
| mozilla seamonkey | = 1.1.5 | No fix listed |
| mozilla seamonkey | = 1.1.6 | No fix listed |
| mozilla seamonkey | = 1.1.7 | No fix listed |
| mozilla seamonkey | = 1.1.8 | No fix listed |
| mozilla seamonkey | = 1.1.9 | No fix listed |
| mozilla seamonkey | = 1.1.10 | No fix listed |
| mozilla seamonkey | = 1.1.11 | No fix listed |
| mozilla seamonkey | = 1.1.12 | No fix listed |
| mozilla seamonkey | = 1.1.13 | No fix listed |
| mozilla seamonkey | = 1.1.14 | No fix listed |
| mozilla seamonkey | = 1.1.15 | No fix listed |
| mozilla seamonkey | = 1.1.16 | No fix listed |
| mozilla seamonkey | = 1.1.17 | No fix listed |
| mozilla seamonkey | = 1.1.18 | No fix listed |
| mozilla seamonkey | = 1.1.19 | No fix listed |
| mozilla seamonkey | = 1.5.0.8 | No fix listed |
| mozilla seamonkey | = 1.5.0.9 | No fix listed |
| mozilla seamonkey | = 1.5.0.10 | No fix listed |
| mozilla seamonkey | = 2.0 | No fix listed |
| mozilla seamonkey | = 2.0-alpha_1 | No fix listed |
| mozilla seamonkey | = 2.0-alpha_2 | No fix listed |
| mozilla seamonkey | = 2.0-alpha_3 | No fix listed |
| mozilla seamonkey | = 2.0-beta_1 | No fix listed |
| mozilla seamonkey | = 2.0-beta_2 | No fix listed |
| mozilla seamonkey | = 2.0-rc1 | No fix listed |
| mozilla seamonkey | = 2.0-rc2 | No fix listed |
| mozilla seamonkey | = 2.0.1 | No fix listed |
| mozilla seamonkey | = 2.0.2 | No fix listed |
| mozilla seamonkey | = 2.0.3 | No fix listed |
| mozilla seamonkey | = 2.0.4 | No fix listed |
| mozilla seamonkey | = 2.0.5 | No fix listed |
| mozilla seamonkey | = 2.0.6 | No fix listed |
| mozilla seamonkey | = 2.0.7 | No fix listed |
| mozilla seamonkey | = 2.0.8 | No fix listed |
| mozilla seamonkey | = 2.0.9 | No fix listed |
| mozilla seamonkey | = 2.0.10 | No fix listed |
| mozilla seamonkey | = 2.0.11 | No fix listed |
| mozilla seamonkey | = 2.0.12 | No fix listed |
| mozilla seamonkey | = 2.0.13 | No fix listed |
| mozilla seamonkey | = 2.0.14 | No fix listed |
| mozilla seamonkey | = 2.1 | No fix listed |
| mozilla seamonkey | = 2.1-alpha1 | No fix listed |
| mozilla seamonkey | = 2.1-alpha2 | No fix listed |
| mozilla seamonkey | = 2.1-alpha3 | No fix listed |
| mozilla seamonkey | = 2.1-beta1 | No fix listed |
| mozilla seamonkey | = 2.1-beta2 | No fix listed |
| mozilla seamonkey | = 2.1-beta3 | No fix listed |
| mozilla seamonkey | = 2.1-rc1 | No fix listed |
| mozilla seamonkey | = 2.1-rc2 | No fix listed |
| mozilla seamonkey | = 2.2 | No fix listed |
| mozilla seamonkey | = 2.2-beta1 | No fix listed |
| mozilla seamonkey | = 2.2-beta2 | No fix listed |
| mozilla seamonkey | = 2.2-beta3 | No fix listed |
| mozilla seamonkey | = 2.10 | No fix listed |
| mozilla seamonkey | = 2.10-beta1 | No fix listed |
| mozilla seamonkey | = 2.10-beta2 | No fix listed |
| mozilla seamonkey | = 2.10-beta3 | No fix listed |
| mozilla seamonkey | = 2.10.1 | No fix listed |
| mozilla seamonkey | = 2.11 | No fix listed |
| mozilla seamonkey | = 2.11-beta1 | No fix listed |
| mozilla seamonkey | = 2.11-beta2 | No fix listed |
| mozilla seamonkey | = 2.11-beta3 | No fix listed |
| mozilla seamonkey | = 2.11-beta4 | No fix listed |
| mozilla seamonkey | = 2.11-beta5 | No fix listed |
| mozilla seamonkey | = 2.11-beta6 | No fix listed |
| mozilla seamonkey | = 2.12 | No fix listed |
| mozilla seamonkey | = 2.12-beta1 | No fix listed |
| mozilla seamonkey | = 2.12-beta2 | No fix listed |
| mozilla seamonkey | = 2.12-beta3 | No fix listed |
| mozilla seamonkey | = 2.12-beta4 | No fix listed |
| mozilla seamonkey | = 2.12-beta5 | No fix listed |
| mozilla seamonkey | = 2.12-beta6 | No fix listed |
| mozilla seamonkey | = 2.12.1 | No fix listed |
| mozilla seamonkey | = 2.13 | No fix listed |
| mozilla seamonkey | = 2.13-beta1 | No fix listed |
| mozilla seamonkey | = 2.13-beta2 | No fix listed |
| mozilla seamonkey | = 2.13-beta3 | No fix listed |
| mozilla seamonkey | = 2.13-beta4 | No fix listed |
| mozilla seamonkey | = 2.13-beta5 | No fix listed |
| mozilla seamonkey | = 2.13-beta6 | No fix listed |
| mozilla seamonkey | = 2.13.1 | No fix listed |
| mozilla seamonkey | = 2.13.2 | No fix listed |
| mozilla seamonkey | = 2.14 | No fix listed |
| mozilla seamonkey | = 2.14-beta1 | No fix listed |
| mozilla seamonkey | = 2.14-beta2 | No fix listed |
| mozilla seamonkey | = 2.14-beta3 | No fix listed |
| mozilla seamonkey | = 2.14-beta4 | No fix listed |
| mozilla seamonkey | = 2.14-beta5 | No fix listed |
| mozilla seamonkey | = 2.15 | No fix listed |
| mozilla seamonkey | = 2.15-beta1 | No fix listed |
| mozilla seamonkey | = 2.15-beta2 | No fix listed |
| mozilla seamonkey | = 2.15-beta3 | No fix listed |
| mozilla seamonkey | = 2.15-beta4 | No fix listed |
| mozilla seamonkey | = 2.15-beta5 | No fix listed |
| mozilla seamonkey | = 2.15-beta6 | No fix listed |
| mozilla seamonkey | = 2.15.1 | No fix listed |
| mozilla seamonkey | = 2.15.2 | No fix listed |
| mozilla seamonkey | = 2.16 | No fix listed |
| mozilla seamonkey | = 2.16-beta1 | No fix listed |
| mozilla seamonkey | = 2.16-beta2 | No fix listed |
| mozilla seamonkey | = 2.16-beta3 | No fix listed |
| mozilla seamonkey | = 2.16-beta4 | No fix listed |
| mozilla seamonkey | = 2.16-beta5 | No fix listed |
| mozilla seamonkey | = 2.16.1 | No fix listed |
| mozilla seamonkey | = 2.16.2 | No fix listed |
| mozilla seamonkey | = 2.17 | No fix listed |
| mozilla seamonkey | = 2.17-beta1 | No fix listed |
| mozilla seamonkey | = 2.17-beta2 | No fix listed |
References
- Debian Security Tracker CVE-2014-1568 vendor-advisory
- googlechromereleases.blogspot.com
- googlechromereleases.blogspot.com
- kb.juniper.net
- kb.juniper.net
- SUSE-SU-2014:1220 vendor-advisory
- openSUSE-SU-2014:1224 vendor-advisory
- openSUSE-SU-2014:1232 vendor-advisory
- RHSA-2014:1307 vendor-advisory
- RHSA-2014:1354 vendor-advisory
- RHSA-2014:1371 vendor-advisory
- 61540 third-party-advisory
- 61574 third-party-advisory
- 61575 third-party-advisory
- 61576 third-party-advisory
- 61583 third-party-advisory
- DSA-3033 vendor-advisory
- DSA-3034 vendor-advisory
- DSA-3037 vendor-advisory
- VU#772676 third-party-advisory us-government-resource
- www.mozilla.org vendor-advisory
- www.novell.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- www.oracle.com
- 70116 vdb-entry
- USN-2360-1 vendor-advisory
- USN-2360-2 vendor-advisory
- USN-2361-1 vendor-advisory
- bugzilla.mozilla.org
- bugzilla.mozilla.org vendor-advisory
- mozilla-nss-cve20141568-sec-bypass(96194) vdb-entry
- GLSA-201504-01 vendor-advisory