CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
AI Score
Confidence
High
EPSS
Percentile
90.9%
The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm.
Vendor | Product | Version | CPE |
---|---|---|---|
suse | linux_enterprise_desktop | 11 | cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:* |
suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:* |
suse | linux_enterprise_server | 11 | cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:* |
suse | linux_enterprise_software_development_kit | 11 | cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:* |
oracle | solaris | 11.3 | cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:* |
opensuse | opensuse | 13.1 | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
opensuse_project | opensuse | 11.4 | cpe:2.3:o:opensuse_project:opensuse:11.4:*:*:*:*:*:*:* |
opensuse_project | opensuse | 12.3 | cpe:2.3:o:opensuse_project:opensuse:12.3:*:*:*:*:*:*:* |
mozilla | seamonkey | * | cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:* |
mozilla | firefox | * | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html
lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html
lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.html
www.mozilla.org/security/announce/2014/mfsa2014-18.html
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
bugzilla.mozilla.org/show_bug.cgi?id=935618
security.gentoo.org/glsa/201504-01