nss: RSA PKCS#1 signature verification forgery flaw (MFSA 2014-73)

🗓️ 02 Oct 2014 18:40:05Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 45 Views

NSS RSA PKCS#1 signature verification forgery flaw lets remote attackers forge RSA certificates via crafted signatures.

Reporter	Title	Published	Views	Family All 187
IBM Security Bulletins	Security Bulletin: Tivoli Common Reporting iFixes for multiple Security Vulnerabilities (CVE-2014-3566,CVE-2014-6145,CVE-2014-1568,CVE-2014-4263,CVE-2014-3513,CVE-2014-3567,CVE-2014-3568,CVE-2014-0107,CVE-2014-0075,CVE-2014-0096,CVE-2014-0099,CVE-2014-011	17 Jun 201814:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Business Intelligence Server is affected by multiple vulnerabilities (CVE-2014-3566, CVE-2014-6145, CVE-2014-1568, CVE-2014-4263, CVE-2012-5784, CVE-2014-3513, CVE-2014-3567 and CVE-2014-3568).	15 Jun 201823:13	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been identified in multiple products that ship with IBM Predictive Customer Intelligence (CVE-2014-3566)	11 Feb 202021:31	–	ibm
IBM Security Bulletins	Security Bulletins - Cognos Analytics and Cognos Business Intelligence	19 Jul 201816:57	–	ibm
FreeBSD	NSS -- RSA Signature Forgery	23 Sep 201400:00	–	freebsd
FreeBSD	chromium -- RSA signature malleability in NSS	24 Sep 201400:00	–	freebsd
Tenable Nessus	Mozilla Firefox ESR < 24.8.1 RSA Signature Forgery in NSS	6 Nov 201900:00	–	nessus
Tenable Nessus	Google Chrome < 37.0.2062.124 RSA Signature Forgery in NSS	6 Oct 201400:00	–	nessus
Tenable Nessus	SeaMonkey < 2.29.1 RSA Signature Forgery in NSS	6 Oct 201400:00	–	nessus
Tenable Nessus	Mozilla Thunderbird < 31.1.2 RSA Signature Forgery in NSS	6 Oct 201400:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	6	noarch	rhev-hypervisor6	6.5-20140930.1.el6ev	rhev-hypervisor6-6.5-20140930.1.el6ev.noarch.rpm

Source	Link
mozilla	www.mozilla.org/security/announce/2014/mfsa2014-73.html
access	www.access.redhat.com/security/cve/CVE-2014-1568
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2014-1568
cve	www.cve.org/CVERecord

28 Jul 2026 16:28Current

6.7Medium risk

Vulners AI Score6.7

CVSS 27.5

EPSS0.16043

asn one parsing signature forgery certificate forgery remote attacker