9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.956 High
EPSS
Percentile
99.4%
In the NSS library before version 3.16, in a wildcard certificate, the wildcard character was embedded within the U-label of an internationalized domain name, which is not in accordance with RFC 6125 (CVE-2014-1492). Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox or Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running it (CVE-2014-1493, CVE-2014-1510, CVE-2014-1511, CVE-2014-1512, CVE-2014-1513, CVE-2014-1514). Several information disclosure flaws were found in the way Firefox and Thunderbird processed malformed web content. An attacker could use these flaws to gain access to sensitive information such as cross-domain content or protected memory addresses or, potentially, cause Firefox or Thunderbird to crash (CVE-2014-1497, CVE-2014-1508, CVE-2014-1505). A memory corruption flaw was found in the way Firefox and Thunderbird rendered certain PDF files. An attacker able to trick a user into installing a malicious extension could use this flaw to crash Firefox or, potentially, execute arbitrary code with the privileges of the user running Firefox or Thunderbird (CVE-2014-1509).
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Mageia | 3 | noarch | rootcerts | < 20140318.00-1 | rootcerts-20140318.00-1.mga3 |
Mageia | 3 | noarch | nspr | < 4.10.4-1 | nspr-4.10.4-1.mga3 |
Mageia | 3 | noarch | nss | < 3.16.0-1 | nss-3.16.0-1.mga3 |
Mageia | 3 | noarch | firefox | < 24.4.0-1 | firefox-24.4.0-1.mga3 |
Mageia | 3 | noarch | firefox-l10n | < 24.4.0-1 | firefox-l10n-24.4.0-1.mga3 |
Mageia | 3 | noarch | thunderbird | < 24.4.0-1 | thunderbird-24.4.0-1.mga3 |
Mageia | 3 | noarch | thunderbird-l10n | < 24.4.0-1 | thunderbird-l10n-24.4.0-1.mga3 |
Mageia | 4 | noarch | rootcerts | < 20140318.00-1 | rootcerts-20140318.00-1.mga4 |
Mageia | 4 | noarch | nspr | < 4.10.4-1 | nspr-4.10.4-1.mga4 |
Mageia | 4 | noarch | nss | < 3.16.0-1 | nss-3.16.0-1.mga4 |
www.mozilla.org/security/known-vulnerabilities/firefoxESR.html
bugs.mageia.org/show_bug.cgi?id=13042
developer.mozilla.org/en-US/docs/NSS/NSS_3.16_release_notes
rhn.redhat.com/errata/RHSA-2014-0310.html
www.mozilla.org/security/announce/2014/mfsa2014-15.html
www.mozilla.org/security/announce/2014/mfsa2014-17.html
www.mozilla.org/security/announce/2014/mfsa2014-26.html
www.mozilla.org/security/announce/2014/mfsa2014-27.html
www.mozilla.org/security/announce/2014/mfsa2014-28.html
www.mozilla.org/security/announce/2014/mfsa2014-29.html
www.mozilla.org/security/announce/2014/mfsa2014-30.html
www.mozilla.org/security/announce/2014/mfsa2014-31.html
www.mozilla.org/security/announce/2014/mfsa2014-32.html
www.mozilla.org/security/known-vulnerabilities/thunderbird.html
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.956 High
EPSS
Percentile
99.4%