NetSight
IP …
medium4.3

CVE-2014-1491

Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey…

Impact

Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.

Affected products

VendorProductAffected versions
MozillaFirefox
before 24.3
before 27.0
MozillaNetwork Security Services
before 3.15.4
MozillaSeamonkey
before 2.24
MozillaThunderbird
before 24.3.0
OracleEnterprise Manager Ops Center
before 12.1.4
Versions 12.2.0, 12.2.1, 12.3.0
OracleVm Server
Version 3.2
FedoraprojectFedora
Versions 19, 20
OpensuseOpensuse
Versions 11.4, 12.3, 13.1
SuseLinux Enterprise Desktop
Version 11
SuseLinux Enterprise Server
Version 11
SuseLinux Enterprise Software Development Kit
Version 11
DebianDebian Linux
Versions 7.0, 8.0

Weakness classification

CWE-326

References