PRIOn knowledge basePRION:CVE-2014-1568Design/Logic Flaw
6.6 Medium
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.044 Low
EPSS
Percentile
92.2%
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a “signature malleability” issue.
| CPE | Name | Operator | Version |
|---|---|---|---|
| chrome | le | 37.0.2062.120 | |
| chrome | le | 37.0.2062.103 | |
| chrome | eq | 37.0.2062.0 | |
| chrome | eq | 37.0.2062.3 | |
| chrome | eq | 37.0.2062.20 | |
| chrome | eq | 37.0.2062.100 | |
| chrome | eq | 37.0.2062.102 | |
| firefox | le | 32.0 | |
| firefox | eq | 32.0.1 | |
| firefox | eq | 32.0.2 |
References
kb.juniper.net/InfoCenter/index?page=content&id=JSA10698
kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
lists.opensuse.org/opensuse-security-announce/2014-09/msg00032.html
lists.opensuse.org/opensuse-security-announce/2014-09/msg00036.html
lists.opensuse.org/opensuse-security-announce/2014-09/msg00039.html
rhn.redhat.com/errata/RHSA-2014-1307.html
rhn.redhat.com/errata/RHSA-2014-1354.html
rhn.redhat.com/errata/RHSA-2014-1371.html
secunia.com/advisories/61540
secunia.com/advisories/61574
secunia.com/advisories/61575
secunia.com/advisories/61576
secunia.com/advisories/61583
www.debian.org/security/2014/dsa-3033
www.debian.org/security/2014/dsa-3034
www.debian.org/security/2014/dsa-3037
www.kb.cert.org/vuls/id/772676
www.mozilla.org/security/announce/2014/mfsa2014-73.html
www.novell.com/support/kb/doc.php?id=7015701
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
www.securityfocus.com/bid/70116
www.ubuntu.com/usn/USN-2360-1
www.ubuntu.com/usn/USN-2360-2
www.ubuntu.com/usn/USN-2361-1
bugzilla.mozilla.org/show_bug.cgi?id=1064636
bugzilla.mozilla.org/show_bug.cgi?id=1069405
exchange.xforce.ibmcloud.com/vulnerabilities/96194
googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html
googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html
security.gentoo.org/glsa/201504-01
Related
6.6 Medium
AI Score
Confidence
Low
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.044 Low
EPSS
Percentile
92.2%