Lucene search
HistorySep 25, 2014 - 5:55 p.m.
CVE-2014-1568
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
5.2 Medium
AI Score
Confidence
High
0.038 Low
EPSS
Percentile
91.9%
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a “signature malleability” issue.
Affected configurations
Node
googlechromeRange≤37.0.2062.120
applemac_os_x
ORmicrosoftwindows
Node
mozillafirefoxRange≤32.0
ORmozillafirefoxMatch32.0.1
ORmozillafirefoxMatch32.0.2
ORmozillafirefox_esrMatch24.8.0
ORmozillafirefox_esrMatch31.0
ORmozillafirefox_esrMatch31.1.0
ORmozillanetwork_security_servicesRange≤3.16.2.0
ORmozillanetwork_security_servicesMatch3.2
ORmozillanetwork_security_servicesMatch3.2.1
ORmozillanetwork_security_servicesMatch3.3
ORmozillanetwork_security_servicesMatch3.3.1
ORmozillanetwork_security_servicesMatch3.3.2
ORmozillanetwork_security_servicesMatch3.4
ORmozillanetwork_security_servicesMatch3.4.1
ORmozillanetwork_security_servicesMatch3.4.2
ORmozillanetwork_security_servicesMatch3.5
ORmozillanetwork_security_servicesMatch3.6
ORmozillanetwork_security_servicesMatch3.6.1
ORmozillanetwork_security_servicesMatch3.7
ORmozillanetwork_security_servicesMatch3.7.1
ORmozillanetwork_security_servicesMatch3.7.2
ORmozillanetwork_security_servicesMatch3.7.3
ORmozillanetwork_security_servicesMatch3.7.5
ORmozillanetwork_security_servicesMatch3.7.7
ORmozillanetwork_security_servicesMatch3.8
ORmozillanetwork_security_servicesMatch3.9
ORmozillanetwork_security_servicesMatch3.11.2
ORmozillanetwork_security_servicesMatch3.11.3
ORmozillanetwork_security_servicesMatch3.11.4
ORmozillanetwork_security_servicesMatch3.11.5
ORmozillanetwork_security_servicesMatch3.12
ORmozillanetwork_security_servicesMatch3.12.1
ORmozillanetwork_security_servicesMatch3.12.2
ORmozillanetwork_security_servicesMatch3.12.3
ORmozillanetwork_security_servicesMatch3.12.3.1
ORmozillanetwork_security_servicesMatch3.12.3.2
ORmozillanetwork_security_servicesMatch3.12.4
ORmozillanetwork_security_servicesMatch3.12.5
ORmozillanetwork_security_servicesMatch3.12.6
ORmozillanetwork_security_servicesMatch3.12.7
ORmozillanetwork_security_servicesMatch3.12.8
ORmozillanetwork_security_servicesMatch3.12.9
ORmozillanetwork_security_servicesMatch3.12.10
ORmozillanetwork_security_servicesMatch3.12.11
ORmozillanetwork_security_servicesMatch3.14
ORmozillanetwork_security_servicesMatch3.14.1
ORmozillanetwork_security_servicesMatch3.14.2
ORmozillanetwork_security_servicesMatch3.14.3
ORmozillanetwork_security_servicesMatch3.14.4
ORmozillanetwork_security_servicesMatch3.14.5
ORmozillanetwork_security_servicesMatch3.15
ORmozillanetwork_security_servicesMatch3.15.1
ORmozillanetwork_security_servicesMatch3.15.2
ORmozillanetwork_security_servicesMatch3.15.3
ORmozillanetwork_security_servicesMatch3.15.3.1
ORmozillanetwork_security_servicesMatch3.15.4
ORmozillanetwork_security_servicesMatch3.15.5
ORmozillanetwork_security_servicesMatch3.16
ORmozillanetwork_security_servicesMatch3.16.1
ORmozillanetwork_security_servicesMatch3.16.3
ORmozillanetwork_security_servicesMatch3.16.4
ORmozillaseamonkey
ORmozillaseamonkeyRange≤2.29-
ORmozillaseamonkeyMatch1.0
ORmozillaseamonkeyMatch1.0alpha
ORmozillaseamonkeyMatch1.0beta
ORmozillaseamonkeyMatch1.0.1
ORmozillaseamonkeyMatch1.0.2
ORmozillaseamonkeyMatch1.0.3
ORmozillaseamonkeyMatch1.0.4
ORmozillaseamonkeyMatch1.0.5
ORmozillaseamonkeyMatch1.0.6
ORmozillaseamonkeyMatch1.0.7
ORmozillaseamonkeyMatch1.0.8
ORmozillaseamonkeyMatch1.0.9
ORmozillaseamonkeyMatch1.1
ORmozillaseamonkeyMatch1.1alpha
ORmozillaseamonkeyMatch1.1beta
ORmozillaseamonkeyMatch1.1.1
ORmozillaseamonkeyMatch1.1.2
ORmozillaseamonkeyMatch1.1.3
ORmozillaseamonkeyMatch1.1.4
ORmozillaseamonkeyMatch1.1.5
ORmozillaseamonkeyMatch1.1.6
ORmozillaseamonkeyMatch1.1.7
ORmozillaseamonkeyMatch1.1.8
ORmozillaseamonkeyMatch1.1.9
ORmozillaseamonkeyMatch1.1.10
ORmozillaseamonkeyMatch1.1.11
ORmozillaseamonkeyMatch1.1.12
ORmozillaseamonkeyMatch1.1.13
ORmozillaseamonkeyMatch1.1.14
ORmozillaseamonkeyMatch1.1.15
ORmozillaseamonkeyMatch1.1.16
ORmozillaseamonkeyMatch1.1.17
ORmozillaseamonkeyMatch1.1.18
ORmozillaseamonkeyMatch1.1.19
ORmozillaseamonkeyMatch1.5.0.8
ORmozillaseamonkeyMatch1.5.0.9
ORmozillaseamonkeyMatch1.5.0.10
ORmozillaseamonkeyMatch2.0
ORmozillaseamonkeyMatch2.0alpha_1
ORmozillaseamonkeyMatch2.0alpha_2
ORmozillaseamonkeyMatch2.0alpha_3
ORmozillaseamonkeyMatch2.0beta_1
ORmozillaseamonkeyMatch2.0beta_2
ORmozillaseamonkeyMatch2.0rc1
ORmozillaseamonkeyMatch2.0rc2
ORmozillaseamonkeyMatch2.0.1
ORmozillaseamonkeyMatch2.0.2
ORmozillaseamonkeyMatch2.0.3
ORmozillaseamonkeyMatch2.0.4
ORmozillaseamonkeyMatch2.0.5
ORmozillaseamonkeyMatch2.0.6
ORmozillaseamonkeyMatch2.0.7
ORmozillaseamonkeyMatch2.0.8
ORmozillaseamonkeyMatch2.0.9
ORmozillaseamonkeyMatch2.0.10
ORmozillaseamonkeyMatch2.0.11
ORmozillaseamonkeyMatch2.0.12
ORmozillaseamonkeyMatch2.0.13
ORmozillaseamonkeyMatch2.0.14
ORmozillaseamonkeyMatch2.1
ORmozillaseamonkeyMatch2.1alpha1
ORmozillaseamonkeyMatch2.1alpha2
ORmozillaseamonkeyMatch2.1alpha3
ORmozillaseamonkeyMatch2.1beta1
ORmozillaseamonkeyMatch2.1beta2
ORmozillaseamonkeyMatch2.1beta3
ORmozillaseamonkeyMatch2.1rc1
ORmozillaseamonkeyMatch2.1rc2
ORmozillaseamonkeyMatch2.2
ORmozillaseamonkeyMatch2.2beta1
ORmozillaseamonkeyMatch2.2beta2
ORmozillaseamonkeyMatch2.2beta3
ORmozillaseamonkeyMatch2.10
ORmozillaseamonkeyMatch2.10beta1
ORmozillaseamonkeyMatch2.10beta2
ORmozillaseamonkeyMatch2.10beta3
ORmozillaseamonkeyMatch2.10.1
ORmozillaseamonkeyMatch2.11
ORmozillaseamonkeyMatch2.11beta1
ORmozillaseamonkeyMatch2.11beta2
ORmozillaseamonkeyMatch2.11beta3
ORmozillaseamonkeyMatch2.11beta4
ORmozillaseamonkeyMatch2.11beta5
ORmozillaseamonkeyMatch2.11beta6
ORmozillaseamonkeyMatch2.12
ORmozillaseamonkeyMatch2.12beta1
ORmozillaseamonkeyMatch2.12beta2
ORmozillaseamonkeyMatch2.12beta3
ORmozillaseamonkeyMatch2.12beta4
ORmozillaseamonkeyMatch2.12beta5
ORmozillaseamonkeyMatch2.12beta6
ORmozillaseamonkeyMatch2.12.1
ORmozillaseamonkeyMatch2.13
ORmozillaseamonkeyMatch2.13beta1
ORmozillaseamonkeyMatch2.13beta2
ORmozillaseamonkeyMatch2.13beta3
ORmozillaseamonkeyMatch2.13beta4
ORmozillaseamonkeyMatch2.13beta5
ORmozillaseamonkeyMatch2.13beta6
ORmozillaseamonkeyMatch2.13.1
ORmozillaseamonkeyMatch2.13.2
ORmozillaseamonkeyMatch2.14
ORmozillaseamonkeyMatch2.14beta1
ORmozillaseamonkeyMatch2.14beta2
ORmozillaseamonkeyMatch2.14beta3
ORmozillaseamonkeyMatch2.14beta4
ORmozillaseamonkeyMatch2.14beta5
ORmozillaseamonkeyMatch2.15
ORmozillaseamonkeyMatch2.15beta1
ORmozillaseamonkeyMatch2.15beta2
ORmozillaseamonkeyMatch2.15beta3
ORmozillaseamonkeyMatch2.15beta4
ORmozillaseamonkeyMatch2.15beta5
ORmozillaseamonkeyMatch2.15beta6
ORmozillaseamonkeyMatch2.15.1
ORmozillaseamonkeyMatch2.15.2
ORmozillaseamonkeyMatch2.16
ORmozillaseamonkeyMatch2.16beta1
ORmozillaseamonkeyMatch2.16beta2
ORmozillaseamonkeyMatch2.16beta3
ORmozillaseamonkeyMatch2.16beta4
ORmozillaseamonkeyMatch2.16beta5
ORmozillaseamonkeyMatch2.16.1
ORmozillaseamonkeyMatch2.16.2
ORmozillaseamonkeyMatch2.17
ORmozillaseamonkeyMatch2.17beta1
ORmozillaseamonkeyMatch2.17beta2
ORmozillaseamonkeyMatch2.17beta3
ORmozillaseamonkeyMatch2.17beta4
ORmozillaseamonkeyMatch2.17.1
ORmozillaseamonkeyMatch2.18beta1
ORmozillaseamonkeyMatch2.18beta2
ORmozillaseamonkeyMatch2.18beta3
ORmozillaseamonkeyMatch2.18beta4
ORmozillaseamonkeyMatch2.19
ORmozillaseamonkeyMatch2.19beta1
ORmozillaseamonkeyMatch2.19beta2
ORmozillaseamonkeyMatch2.20
ORmozillaseamonkeyMatch2.20beta1
ORmozillaseamonkeyMatch2.20beta2
ORmozillaseamonkeyMatch2.20beta3
ORmozillaseamonkeyMatch2.21beta1
ORmozillaseamonkeyMatch2.21beta2
ORmozillaseamonkeyMatch2.22beta1
ORmozillaseamonkeyMatch2.22beta2
ORmozillaseamonkeyMatch2.22.1
ORmozillaseamonkeyMatch2.23
ORmozillaseamonkeyMatch2.23beta1
ORmozillaseamonkeyMatch2.24
ORmozillaseamonkeyMatch2.24beta1
ORmozillaseamonkeyMatch2.25-
ORmozillaseamonkeyMatch2.25beta1
ORmozillaseamonkeyMatch2.25beta2
ORmozillaseamonkeyMatch2.25beta3
ORmozillaseamonkeyMatch2.26-
ORmozillaseamonkeyMatch2.26rc1
ORmozillathunderbirdRange≤24.8.0
ORmozillathunderbirdMatch31.0
ORmozillathunderbirdMatch31.1.0
ORmozillathunderbirdMatch31.1.1
Node
googlechromeRange≤37.0.2062.103
ORgooglechromeMatch37.0.2062.0
ORgooglechromeMatch37.0.2062.3
ORgooglechromeMatch37.0.2062.20
ORgooglechromeMatch37.0.2062.100
ORgooglechromeMatch37.0.2062.102
googlechrome_os
References
googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html
googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html
kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
lists.opensuse.org/opensuse-security-announce/2014-09/msg00032.html
lists.opensuse.org/opensuse-security-announce/2014-09/msg00036.html
lists.opensuse.org/opensuse-security-announce/2014-09/msg00039.html
rhn.redhat.com/errata/RHSA-2014-1307.html
rhn.redhat.com/errata/RHSA-2014-1354.html
rhn.redhat.com/errata/RHSA-2014-1371.html
secunia.com/advisories/61540
secunia.com/advisories/61574
secunia.com/advisories/61575
secunia.com/advisories/61576
secunia.com/advisories/61583
www.debian.org/security/2014/dsa-3033
www.debian.org/security/2014/dsa-3034
www.debian.org/security/2014/dsa-3037
www.kb.cert.org/vuls/id/772676
www.mozilla.org/security/announce/2014/mfsa2014-73.html
www.novell.com/support/kb/doc.php?id=7015701
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
www.securityfocus.com/bid/70116
www.ubuntu.com/usn/USN-2360-1
www.ubuntu.com/usn/USN-2360-2
www.ubuntu.com/usn/USN-2361-1
bugzilla.mozilla.org/show_bug.cgi?id=1064636
bugzilla.mozilla.org/show_bug.cgi?id=1069405
exchange.xforce.ibmcloud.com/vulnerabilities/96194
security.gentoo.org/glsa/201504-01
Related
nessus
nessus
Mandriva Linux Security Advisory : nss (MDVSA-2014:189)
2014-09-26 00:00:00
OracleVM 3.3 : nss (OVMSA-2014-0082)
2014-12-15 00:00:00
RHEL 5 / 6 / 7 : nss (RHSA-2014:1307)
2014-09-26 00:00:00
cert
cert
suse
suse
NSS update to avoid signature forgery (critical)
2014-09-28 12:04:18
Security update for mozilla-nss (important)
2014-10-01 17:04:53
mozilla-nss: update to avoid signature forgery (critical)
2014-09-28 12:07:03
openvas
openvas
CentOS Update for nss CESA-2014:1307 centos7
2014-10-01 00:00:00
Amazon Linux: Security Advisory (ALAS-2014-424)
2015-09-08 00:00:00
Mozilla Firefox ESR RSA Spoof Vulnerability (Sep 2014) - Windows
2014-09-29 00:00:00
centos
centos
nss security update
2014-09-26 11:29:24
debian
debian
[SECURITY] [DSA 3033-1] nss security update
2014-09-25 00:23:40
[SECURITY] [DLA 62-1] nss security update
2014-09-25 14:59:30
[SECURITY] [DSA 3037-1] icedove security update
2014-09-26 19:31:43
osv
osv
nss - security update
2014-09-25 00:00:00
CVE-2018-16253
2018-11-07 20:29:00
CVE-2018-16152
2018-09-26 21:29:01
prion
prion
Design/Logic Flaw
2014-09-25 17:55:00
Design/Logic Flaw
2018-09-26 21:29:00
Code injection
2018-11-07 20:29:00
mozilla
mozilla
RSA Signature Forgery in NSS — Mozilla
2014-09-24 00:00:00
freebsd
freebsd
NSS -- RSA Signature Forgery
2014-09-23 00:00:00
chromium -- RSA signature malleability in NSS
2014-09-24 00:00:00
redhat
redhat
(RHSA-2014:1371) Important: nss security update
2014-10-10 00:00:00
(RHSA-2014:1307) Important: nss security update
2014-09-26 00:00:00
(RHSA-2014:1354) Critical: rhev-hypervisor6 security update
2014-10-02 00:00:00
ubuntu
ubuntu
NSS vulnerability
2014-09-24 00:00:00
Firefox vulnerabilities
2014-09-24 00:00:00
Thunderbird vulnerabilities
2014-09-24 00:00:00
amazon
amazon
Important: nss-softokn
2014-10-01 16:32:00
Important: nss-util
2014-10-01 16:32:00
Important: nss
2014-10-01 16:32:00
fedora
fedora
[SECURITY] Fedora 21 Update: nss-softokn-3.17.1-2.fc21
2014-09-29 04:00:06
[SECURITY] Fedora 21 Update: nss-util-3.17.1-1.fc21
2014-09-29 04:00:07
[SECURITY] Fedora 21 Update: nss-3.17.1-1.fc21
2014-09-29 04:00:07
ubuntucve
ubuntucve
CVE-2014-1568
2014-09-24 00:00:00
CVE-2018-16152
2018-09-24 00:00:00
checkpoint_advisories
checkpoint_advisories
Mozilla Network Security Services RSA Signature Forgery (CVE-2014-1568)
2014-10-19 00:00:00
debiancve
debiancve
cvelist
cvelist
cve
cve
oraclelinux
oraclelinux
nss security update
2014-09-26 00:00:00
nss, nss-util, and nss-softokn security, bug fix, and enhancement update
2014-12-02 00:00:00
chrome
chrome
Stable Channel Update
2014-09-24 00:00:00
archlinux
archlinux
NSS: Signature forgery attack
2014-09-24 00:00:00
mageia
mageia
Updated nss packages fix CVE-2014-1568
2014-09-26 19:55:04
veracode
veracode
Spoofable RSA Signatures
2019-01-15 09:01:59
alpinelinux
alpinelinux
CVE-2018-16152
2018-09-26 21:29:01
nvd
nvd
CVE-2018-16253
2018-11-07 20:29:00
CVE-2018-16152
2018-09-26 21:29:01
redhatcve
redhatcve
CVE-2018-16152
2018-10-03 20:20:39
ibm
ibm
securityvulns
securityvulns
Oracle / Sun / PeopleSoft / MySQL multiple security vulnerabilities
2015-04-17 00:00:00
Oracle / Sun / PeopleSoft / MySQL multiple security vulnerabilities
2015-01-25 00:00:00
Oracle / Sun / PeopleSoft / MySQL multiple security vulnerabilities
2015-07-20 00:00:00
oracle
oracle
Oracle Critical Patch Update - April 2015
2015-04-14 00:00:00
Oracle Critical Patch Update Advisory - January 2015
2015-03-10 00:00:00
Oracle Critical Patch Update Advisory - July 2015
2015-07-14 00:00:00
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2015-04-07 00:00:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
5.2 Medium
AI Score
Confidence
High
0.038 Low
EPSS
Percentile
91.9%
Related for NVD:CVE-2014-1568