CVE-2013-5606

2013-11-1805:23:57

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

9.3

Confidence

High

EPSS

0.008

Percentile

81.7%

JSON

The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate.

Affected configurations

Nvd

Node

mozillanetwork_security_servicesMatch3.15

mozillanetwork_security_servicesMatch3.15.1

mozillanetwork_security_servicesMatch3.15.2

VendorProductVersionCPE
mozillanetwork_security_services3.15cpe:2.3:a:mozilla:network_security_services:3.15:*:*:*:*:*:*:*
mozillanetwork_security_services3.15.1cpe:2.3:a:mozilla:network_security_services:3.15.1:*:*:*:*:*:*:*
mozillanetwork_security_services3.15.2cpe:2.3:a:mozilla:network_security_services:3.15.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mozilla	network_security_services	3.15	cpe:2.3:a:mozilla:network_security_services:3.15:::::::*
mozilla	network_security_services	3.15.1	cpe:2.3:a:mozilla:network_security_services:3.15.1:::::::*
mozilla	network_security_services	3.15.2	cpe:2.3:a:mozilla:network_security_services:3.15.2:::::::*