Vulnerability Details : CVE-2014-1491
Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
Products affected by CVE-2014-1491
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:*:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-1491
0.38%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 70 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-1491
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2014-1491
-
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-1491
-
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
Oracle Critical Patch Update - January 2016Third Party Advisory
-
http://www.debian.org/security/2014/dsa-2858
Debian -- Security Information -- DSA-2858-1 iceweaselThird Party Advisory
-
http://hg.mozilla.org/projects/nss/rev/12c42006aed8
nss: changeset 10965:12c42006aed8e96029c93abb8ebd2fb653f1bd3bPatch;Vendor Advisory
-
http://secunia.com/advisories/56888
Sign inThird Party Advisory
-
http://www.securitytracker.com/id/1029721
Mozilla Thunderbird Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
VMSA-2014-0012.1Not Applicable
-
http://www.securityfocus.com/bid/65332
Mozilla Network Security Services CVE-2014-1491 Unspecified Security VulnerabilityThird Party Advisory;VDB Entry
-
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
Juniper Networks - 2016-10 Security Bulletin: CTPView: Multiple vulnerabilities in CTPViewThird Party Advisory
-
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
Oracle Critical Patch Update - July 2014Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
[security-announce] SUSE-SU-2014:0248-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
[security-announce] openSUSE-SU-2014:0419-1: important: Mozilla updatesMailing List;Third Party Advisory
-
http://secunia.com/advisories/56858
Sign inThird Party Advisory
-
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
Oracle Critical Patch Update - October 2014Third Party Advisory
-
http://www.debian.org/security/2014/dsa-2994
Debian -- Security Information -- DSA-2994-1 nssThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
[security-announce] openSUSE-SU-2014:0212-1: important: Mozilla FirefoxMailing List;Third Party Advisory
-
http://www.securitytracker.com/id/1029717
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
https://security.gentoo.org/glsa/201504-01
Mozilla Products: Multiple vulnerabilities (GLSA 201504-01) — Gentoo securityThird Party Advisory
-
http://seclists.org/fulldisclosure/2014/Dec/23
Full Disclosure: NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilitiesNot Applicable
-
http://www.ubuntu.com/usn/USN-2102-2
USN-2102-2: Firefox regression | Ubuntu security noticesThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
[SECURITY] Fedora 19 Update: thunderbird-24.3.0-1.fc19Third Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=934545
934545 - (CVE-2014-1491) Do not allow p-1 as a public DH valueExploit;Issue Tracking;Patch;Vendor Advisory
-
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
Oracle Critical Patch Update - January 2015Third Party Advisory
-
http://secunia.com/advisories/56922
Sign inThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
[SECURITY] Fedora 20 Update: thunderbird-24.3.0-1.fc20Third Party Advisory
-
http://www.ubuntu.com/usn/USN-2102-1
USN-2102-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.securityfocus.com/archive/1/534161/100/0/threaded
SecurityFocusNot Applicable
-
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
[security-announce] openSUSE-SU-2014:0213-1: important: Mozilla updatesMailing List;Third Party Advisory
-
http://www.securitytracker.com/id/1029720
Mozilla Seamonkey Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016Third Party Advisory
-
http://www.mozilla.org/security/announce/2014/mfsa2014-12.html
NSS ticket handling issues — MozillaThird Party Advisory;Vendor Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/90886
Mozilla Firefox,Thunderbird and SeaMonkey NSS unspecified CVE-2014-1491 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://www.ubuntu.com/usn/USN-2119-1
USN-2119-1: Thunderbird vulnerabilities | Ubuntu security noticesThird Party Advisory
Jump to