VulnerabilityModified

CVE-2014-1490

HIGH 9.3EPSS 3.94%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.94%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.

CVSS 2.0: 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS: 3.94% probability · 90th percentile
CISA KEV: Not listed
Weakness: CWE-362
Affected: mozilla/firefox · mozilla/network security services · mozilla/seamonkey · mozilla/thunderbird · oracle/enterprise manager ops center · oracle/vm server · fedoraproject/fedora · opensuse/opensuse · suse/linux enterprise desktop · suse/linux enterprise server · suse/linux enterprise software development kit · debian/debian linux · canonical/ubuntu linux
Source: security@mozilla.org

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing List, Third Party Advisory
http://osvdb.org/102876Broken Link
http://seclists.org/fulldisclosure/2014/Dec/23Not Applicable
http://secunia.com/advisories/56706Third Party Advisory
http://secunia.com/advisories/56767Third Party Advisory
http://secunia.com/advisories/56787Third Party Advisory
http://secunia.com/advisories/56858Third Party Advisory
http://secunia.com/advisories/56888Third Party Advisory
http://secunia.com/advisories/56922Third Party Advisory
http://www.debian.org/security/2014/dsa-2858Third Party Advisory
http://www.mozilla.org/security/announce/2014/mfsa2014-12.htmlVendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/534161/100/0/threadedNot Applicable
http://www.securityfocus.com/bid/65335Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029717Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029720Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029721Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2102-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2102-2Third Party Advisory
http://www.ubuntu.com/usn/USN-2119-1Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.