VulnerabilityModified

CVE-2014-1491

MEDIUM 4.3EPSS 4.60%

Does this matter?

Lower severity and a low EPSS score (4.60%). Track it; it rarely justifies an emergency change on its own.

Description

Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
EPSS: 4.60% probability · 91th percentile
CISA KEV: Not listed
Weakness: CWE-326
Affected: mozilla/firefox · mozilla/network security services · mozilla/seamonkey · mozilla/thunderbird · oracle/enterprise manager ops center · oracle/vm server · fedoraproject/fedora · opensuse/opensuse · suse/linux enterprise desktop · suse/linux enterprise server · suse/linux enterprise software development kit · debian/debian linux · canonical/ubuntu linux
Source: security@mozilla.org

References

http://hg.mozilla.org/projects/nss/rev/12c42006aed8Patch, Vendor Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2014/Dec/23Not Applicable
http://secunia.com/advisories/56858Third Party Advisory
http://secunia.com/advisories/56888Third Party Advisory
http://secunia.com/advisories/56922Third Party Advisory
http://www.debian.org/security/2014/dsa-2858Third Party Advisory
http://www.debian.org/security/2014/dsa-2994Third Party Advisory
http://www.mozilla.org/security/announce/2014/mfsa2014-12.htmlThird Party Advisory, Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/534161/100/0/threadedNot Applicable
http://www.securityfocus.com/bid/65332Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029717Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029720Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029721Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2102-1Third Party Advisory
http://www.ubuntu.com/usn/USN-2102-2Third Party Advisory
http://www.ubuntu.com/usn/USN-2119-1Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2014-0012.htmlNot Applicable
https://bugzilla.mozilla.org/show_bug.cgi?id=934545Exploit, Issue Tracking, Patch, Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.