CVE-2014-8642 Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to o...
MediumCVSS 4.3
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which there was an incorrect decision to accept a compromised and revoked certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla seamonkey | <= 2.31 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| mozilla Firefox | <= 34.0.5 | No fix listed |
References
- openSUSE-SU-2015:0077 vendor-advisory
- openSUSE-SU-2015:0192 vendor-advisory
- 62242 third-party-advisory
- 62250 third-party-advisory
- 62253 third-party-advisory
- 62316 third-party-advisory
- 62418 third-party-advisory
- 62446 third-party-advisory
- 62790 third-party-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- 72042 vdb-entry
- 1031533 vdb-entry
- bugzilla.mozilla.org
- firefox-cve20148642-sec-bypass(99963) vdb-entry
- GLSA-201504-01 vendor-advisory