Description
Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
Metrics
CVSS 2.0 4.3/10
AV:N/AC:M/Au:N/C:P/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://hg.mozilla.org/projects/nss/rev/12c42006aed8Patch, Vendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2014/Dec/23Not Applicable
- http://secunia.com/advisories/56858Third Party Advisory
- http://secunia.com/advisories/56888Third Party Advisory
- http://secunia.com/advisories/56922Third Party Advisory
- http://www.debian.org/security/2014/dsa-2858Third Party Advisory
- http://www.debian.org/security/2014/dsa-2994Third Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-12.htmlThird Party Advisory, Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/534161/100/0/threadedNot Applicable
- http://www.securityfocus.com/bid/65332Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029717Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029720Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029721Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2102-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2102-2Third Party Advisory
- http://www.ubuntu.com/usn/USN-2119-1Third Party Advisory
- http://www.vmware.com/security/advisories/VMSA-2014-0012.htmlNot Applicable
- https://bugzilla.mozilla.org/show_bug.cgi?id=934545Exploit, Issue Tracking, Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90886Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201504-01Third Party Advisory
- http://hg.mozilla.org/projects/nss/rev/12c42006aed8Patch, Vendor Advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2014/Dec/23Not Applicable
- http://secunia.com/advisories/56858Third Party Advisory
- http://secunia.com/advisories/56888Third Party Advisory
- http://secunia.com/advisories/56922Third Party Advisory
- http://www.debian.org/security/2014/dsa-2858Third Party Advisory
- http://www.debian.org/security/2014/dsa-2994Third Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-12.htmlThird Party Advisory, Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlThird Party Advisory
- http://www.securityfocus.com/archive/1/534161/100/0/threadedNot Applicable
- http://www.securityfocus.com/bid/65332Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029717Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029720Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029721Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2102-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2102-2Third Party Advisory
- http://www.ubuntu.com/usn/USN-2119-1Third Party Advisory
Timeline
- Published
- Feb 6, 2014
- Last modified
- Jun 17, 2026
- NVD status
- Modified