CVEvulnerability
CVE-2014-1491
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-02-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-326
Description
Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
Affected configurations
• mozilla firefox (< 24.3)
• mozilla firefox (< 27.0)
• mozilla network security services (< 3.15.4)
• mozilla seamonkey (< 2.24)
• mozilla thunderbird (< 24.3.0)
• oracle enterprise manager ops center (< 12.1.4)
• oracle enterprise manager ops center 12.2.0
• oracle enterprise manager ops center 12.2.1
• oracle enterprise manager ops center 12.3.0
• oracle vm server 3.2
• fedoraproject fedora 19
• fedoraproject fedora 20
• opensuse opensuse 11.4
• opensuse opensuse 12.3
• opensuse opensuse 13.1
• suse linux enterprise desktop 11
• suse linux enterprise server 11
• suse linux enterprise software development kit 11
• debian debian linux 7.0
• debian debian linux 8.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 12.10
• canonical ubuntu linux 13.10
Related
Weakness · CWE (1)
- CWE-326 Inadequate Encryption Strength weakness
References
- http://hg.mozilla.org/projects/nss/rev/12c42006aed8 Patch, Vendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2014/Dec/23 Not Applicable
- http://secunia.com/advisories/56858 Third Party Advisory
- http://secunia.com/advisories/56888 Third Party Advisory
- http://secunia.com/advisories/56922 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2858 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2994 Third Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-12.html Third Party Advisory, Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
- http://www.securityfocus.com/archive/1/534161/100/0/threaded Not Applicable
- http://www.securityfocus.com/bid/65332 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029717 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029720 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029721 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2102-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2102-2 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2119-1 Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html Not Applicable
- https://bugzilla.mozilla.org/show_bug.cgi?id=934545 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90886 Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201504-01 Third Party Advisory
- http://hg.mozilla.org/projects/nss/rev/12c42006aed8 Patch, Vendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761 Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2014/Dec/23 Not Applicable
- http://secunia.com/advisories/56858 Third Party Advisory
- http://secunia.com/advisories/56888 Third Party Advisory
- http://secunia.com/advisories/56922 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2858 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2994 Third Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-12.html Third Party Advisory, Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
- http://www.securityfocus.com/archive/1/534161/100/0/threaded Not Applicable
- http://www.securityfocus.com/bid/65332 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029717 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029720 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029721 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2102-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2102-2 Third Party Advisory
- http://www.ubuntu.com/usn/USN-2119-1 Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html Not Applicable
- https://bugzilla.mozilla.org/show_bug.cgi?id=934545 Exploit, Issue Tracking, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90886 Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201504-01 Third Party Advisory