Vulnerability Details : CVE-2014-1490
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2014-1490
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-1490
1.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 84 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-1490
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2014-1490
-
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-1490
-
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
Oracle Critical Patch Update - January 2016Third Party Advisory
-
http://www.debian.org/security/2014/dsa-2858
Debian -- Security Information -- DSA-2858-1 iceweaselThird Party Advisory
-
http://secunia.com/advisories/56888
Sign inThird Party Advisory
-
http://www.securitytracker.com/id/1029721
Mozilla Thunderbird Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
https://bugzilla.mozilla.org/show_bug.cgi?id=930857
930857 - NewSessionTicket handshake message in a resumption handshake replaces cached session's ticket before handshake is finishedIssue Tracking;Patch;Vendor Advisory
-
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
VMSA-2014-0012.1Not Applicable
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
Juniper Networks - 2016-10 Security Bulletin: CTPView: Multiple vulnerabilities in CTPViewThird Party Advisory
-
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Oracle Critical Patch Update - July 2014Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
[security-announce] SUSE-SU-2014:0248-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
[security-announce] openSUSE-SU-2014:0419-1: important: Mozilla updatesMailing List;Third Party Advisory
-
https://8pecxstudios.com/?page_id=44080
Broken Link
-
http://secunia.com/advisories/56858
Sign inThird Party Advisory
-
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
Oracle Critical Patch Update - October 2014Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
[security-announce] openSUSE-SU-2014:0212-1: important: Mozilla FirefoxMailing List;Third Party Advisory
-
http://secunia.com/advisories/56787
Sign inThird Party Advisory
-
http://www.securitytracker.com/id/1029717
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
https://security.gentoo.org/glsa/201504-01
Mozilla Products: Multiple vulnerabilities (GLSA 201504-01) — Gentoo securityThird Party Advisory
-
http://seclists.org/fulldisclosure/2014/Dec/23
Full Disclosure: NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilitiesNot Applicable
-
http://www.ubuntu.com/usn/USN-2102-2
USN-2102-2: Firefox regression | Ubuntu security noticesThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
[SECURITY] Fedora 19 Update: thunderbird-24.3.0-1.fc19Third Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=930874
930874 - (CVE-2014-1490) TOCTOU, potential use-after-free in libssl's session ticket processing due to lack of lock protecting the sessionTicket field of the sidIssue Tracking;Patch;Vendor Advisory
-
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
Oracle Critical Patch Update - January 2015Third Party Advisory
-
http://secunia.com/advisories/56922
Sign inThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
[SECURITY] Fedora 20 Update: thunderbird-24.3.0-1.fc20Third Party Advisory
-
http://www.ubuntu.com/usn/USN-2102-1
USN-2102-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.securityfocus.com/bid/65335
Mozilla Network Security Services CVE-2014-1490 Use After Free Memory Corruption VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/archive/1/534161/100/0/threaded
SecurityFocusNot Applicable
-
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
[security-announce] openSUSE-SU-2014:0213-1: important: Mozilla updatesMailing List;Third Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/90885
Mozilla Firefox,Thunderbird and SeaMonkey NSS code execution CVE-2014-1490 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://secunia.com/advisories/56767
Sign inThird Party Advisory
-
http://www.securitytracker.com/id/1029720
Mozilla Seamonkey Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016Third Party Advisory
-
http://osvdb.org/102876
Broken Link
-
http://www.mozilla.org/security/announce/2014/mfsa2014-12.html
NSS ticket handling issues — MozillaVendor Advisory
-
http://www.ubuntu.com/usn/USN-2119-1
USN-2119-1: Thunderbird vulnerabilities | Ubuntu security noticesThird Party Advisory
Jump to