CVEvulnerability
CVE-2014-1490
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-02-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-362
Description
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
Affected configurations
• mozilla firefox (< 24.3)
• mozilla firefox (< 27.0)
• mozilla network security services (< 3.15.4)
• mozilla seamonkey (< 2.24)
• mozilla thunderbird (< 24.3.0)
• oracle enterprise manager ops center (< 12.1.4)
• oracle enterprise manager ops center 12.2.0
• oracle enterprise manager ops center 12.2.1
• oracle enterprise manager ops center 12.3.0
• oracle vm server 3.2
• fedoraproject fedora 19
• fedoraproject fedora 20
• opensuse opensuse 11.4
• opensuse opensuse 12.3
• opensuse opensuse 13.1
• suse linux enterprise desktop 11
• suse linux enterprise server 11
• suse linux enterprise software development kit 11
• debian debian linux 7.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 12.10
• canonical ubuntu linux 13.10
Related
Weakness · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
References
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html Mailing List, Third Party Advisory
- http://osvdb.org/102876 Broken Link
- http://seclists.org/fulldisclosure/2014/Dec/23 Not Applicable
- http://secunia.com/advisories/56706 Third Party Advisory
- http://secunia.com/advisories/56767 Third Party Advisory
- http://secunia.com/advisories/56787 Third Party Advisory
- http://secunia.com/advisories/56858 Third Party Advisory
- http://secunia.com/advisories/56888 Third Party Advisory
- http://secunia.com/advisories/56922 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2858 Third Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-12.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
- http://www.securityfocus.com/archive/1/534161/100/0/threaded Not Applicable
- http://www.securityfocus.com/bid/65335 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029717 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029720 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029721 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2102-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2102-2 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2119-1 Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html Not Applicable
- https://8pecxstudios.com/?page_id=44080 Broken Link, URL Repurposed
- https://bugzilla.mozilla.org/show_bug.cgi?id=930857 Issue Tracking, Patch, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=930874 Issue Tracking, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90885 Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201504-01 Third Party Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html Mailing List, Third Party Advisory
- http://osvdb.org/102876 Broken Link
- http://seclists.org/fulldisclosure/2014/Dec/23 Not Applicable
- http://secunia.com/advisories/56706 Third Party Advisory
- http://secunia.com/advisories/56767 Third Party Advisory
- http://secunia.com/advisories/56787 Third Party Advisory
- http://secunia.com/advisories/56858 Third Party Advisory
- http://secunia.com/advisories/56888 Third Party Advisory
- http://secunia.com/advisories/56922 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2858 Third Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-12.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
- http://www.securityfocus.com/archive/1/534161/100/0/threaded Not Applicable
- http://www.securityfocus.com/bid/65335 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029717 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029720 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029721 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2102-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2102-2 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2119-1 Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html Not Applicable
- https://8pecxstudios.com/?page_id=44080 Broken Link, URL Repurposed
- https://bugzilla.mozilla.org/show_bug.cgi?id=930857 Issue Tracking, Patch, Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=930874 Issue Tracking, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90885 Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201504-01 Third Party Advisory