CVE-2014-1568
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 16.7%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 16.70% probability · 97th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- google/chrome · mozilla/firefox · mozilla/firefox esr · mozilla/network security services · mozilla/seamonkey · mozilla/thunderbird
- Source
- security@mozilla.org
EPSS 16.7% since 4 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html
- http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00039.html
- http://rhn.redhat.com/errata/RHSA-2014-1307.html
- http://rhn.redhat.com/errata/RHSA-2014-1354.html
- http://rhn.redhat.com/errata/RHSA-2014-1371.html
- http://secunia.com/advisories/61540
- http://secunia.com/advisories/61574
- http://secunia.com/advisories/61575
- http://secunia.com/advisories/61576
- http://secunia.com/advisories/61583
- http://www.debian.org/security/2014/dsa-3033
- http://www.debian.org/security/2014/dsa-3034
- http://www.debian.org/security/2014/dsa-3037
- http://www.kb.cert.org/vuls/id/772676US Government Resource
- http://www.mozilla.org/security/announce/2014/mfsa2014-73.htmlVendor Advisory
- http://www.novell.com/support/kb/doc.php?id=7015701
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/70116
- http://www.ubuntu.com/usn/USN-2360-1
- http://www.ubuntu.com/usn/USN-2360-2
- http://www.ubuntu.com/usn/USN-2361-1
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.