CVE-2014-1568

Published: Sep 25, 2014Modified: May 6, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.

Affected (230)

Products: Google: Chrome · Mozilla: Firefox, Firefox Esr, Network Security Services, Seamonkey, Thunderbird

1 product

5 products

Network Security Services

Seamonkey

Thunderbird

Configuration A

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Google Chrome	Up to 37.0.2062.120

Running on/with	Platform Versions
Apple Mac Os X	All versions
Microsoft Windows	All versions

Configuration B

223 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 32.0
Mozilla Firefox	Version 31.0
Mozilla Firefox	Version 31.1.0
Mozilla Firefox	Version 32.0.1
Mozilla Firefox	Version 32.0.2
Mozilla Firefox Esr	Version 24.8.0
Mozilla Network Security Services	Up to 3.16.2.0
Mozilla Network Security Services	Version 3.11.2
Mozilla Network Security Services	Version 3.11.3
Mozilla Network Security Services	Version 3.11.4
Mozilla Network Security Services	Version 3.11.5
Mozilla Network Security Services	Version 3.12.10
Mozilla Network Security Services	Version 3.12.11
Mozilla Network Security Services	Version 3.12.1
Mozilla Network Security Services	Version 3.12.2
Mozilla Network Security Services	Version 3.12.3.1
Mozilla Network Security Services	Version 3.12.3.2
Mozilla Network Security Services	Version 3.12.3
Mozilla Network Security Services	Version 3.12.4
Mozilla Network Security Services	Version 3.12.5
Mozilla Network Security Services	Version 3.12.6
Mozilla Network Security Services	Version 3.12.7
Mozilla Network Security Services	Version 3.12.8
Mozilla Network Security Services	Version 3.12.9
Mozilla Network Security Services	Version 3.12
Mozilla Network Security Services	Version 3.14.1
Mozilla Network Security Services	Version 3.14.2
Mozilla Network Security Services	Version 3.14.3
Mozilla Network Security Services	Version 3.14.4
Mozilla Network Security Services	Version 3.14.5
Mozilla Network Security Services	Version 3.14
Mozilla Network Security Services	Version 3.15.1
Mozilla Network Security Services	Version 3.15.2
Mozilla Network Security Services	Version 3.15.3.1
Mozilla Network Security Services	Version 3.15.3
Mozilla Network Security Services	Version 3.15.4
Mozilla Network Security Services	Version 3.15.5
Mozilla Network Security Services	Version 3.15
Mozilla Network Security Services	Version 3.16.1
Mozilla Network Security Services	Version 3.16.3
Mozilla Network Security Services	Version 3.16.4
Mozilla Network Security Services	Version 3.16
Mozilla Network Security Services	Version 3.2.1
Mozilla Network Security Services	Version 3.2
Mozilla Network Security Services	Version 3.3.1
Mozilla Network Security Services	Version 3.3.2
Mozilla Network Security Services	Version 3.3
Mozilla Network Security Services	Version 3.4.1
Mozilla Network Security Services	Version 3.4.2
Mozilla Network Security Services	Version 3.4
Mozilla Network Security Services	Version 3.5
Mozilla Network Security Services	Version 3.6.1
Mozilla Network Security Services	Version 3.6
Mozilla Network Security Services	Version 3.7.1
Mozilla Network Security Services	Version 3.7.2
Mozilla Network Security Services	Version 3.7.3
Mozilla Network Security Services	Version 3.7.5
Mozilla Network Security Services	Version 3.7.7
Mozilla Network Security Services	Version 3.7
Mozilla Network Security Services	Version 3.8
Mozilla Network Security Services	Version 3.9
Mozilla Seamonkey	All versions
Mozilla Seamonkey	Up to 2.29
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.2
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.5
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.7
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.13
Mozilla Seamonkey	Version 1.1.14
Mozilla Seamonkey	Version 1.1.15
Mozilla Seamonkey	Version 1.1.16
Mozilla Seamonkey	Version 1.1.17
Mozilla Seamonkey	Version 1.1.18
Mozilla Seamonkey	Version 1.1.19
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.2
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.4
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 alpha
Mozilla Seamonkey	Version 1.1 beta
Mozilla Seamonkey	Version 1.5.0.10
Mozilla Seamonkey	Version 1.5.0.8
Mozilla Seamonkey	Version 1.5.0.9
Mozilla Seamonkey	Version 2.0.10
Mozilla Seamonkey	Version 2.0.11
Mozilla Seamonkey	Version 2.0.12
Mozilla Seamonkey	Version 2.0.13
Mozilla Seamonkey	Version 2.0.14
Mozilla Seamonkey	Version 2.0.1
Mozilla Seamonkey	Version 2.0.2
Mozilla Seamonkey	Version 2.0.3
Mozilla Seamonkey	Version 2.0.4
Mozilla Seamonkey	Version 2.0.5
Mozilla Seamonkey	Version 2.0.6
Mozilla Seamonkey	Version 2.0.7
Mozilla Seamonkey	Version 2.0.8
Mozilla Seamonkey	Version 2.0.9
Mozilla Seamonkey	Version 2.0
Mozilla Seamonkey	Version 2.0 alpha_1
Mozilla Seamonkey	Version 2.0 alpha_2
Mozilla Seamonkey	Version 2.0 alpha_3
Mozilla Seamonkey	Version 2.0 beta_1
Mozilla Seamonkey	Version 2.0 beta_2
Mozilla Seamonkey	Version 2.0 rc1
Mozilla Seamonkey	Version 2.0 rc2
Mozilla Seamonkey	Version 2.10.1
Mozilla Seamonkey	Version 2.10
Mozilla Seamonkey	Version 2.10 beta1
Mozilla Seamonkey	Version 2.10 beta2
Mozilla Seamonkey	Version 2.10 beta3
Mozilla Seamonkey	Version 2.11
Mozilla Seamonkey	Version 2.11 beta1
Mozilla Seamonkey	Version 2.11 beta2
Mozilla Seamonkey	Version 2.11 beta3
Mozilla Seamonkey	Version 2.11 beta4
Mozilla Seamonkey	Version 2.11 beta5
Mozilla Seamonkey	Version 2.11 beta6
Mozilla Seamonkey	Version 2.12.1
Mozilla Seamonkey	Version 2.12
Mozilla Seamonkey	Version 2.12 beta1
Mozilla Seamonkey	Version 2.12 beta2
Mozilla Seamonkey	Version 2.12 beta3
Mozilla Seamonkey	Version 2.12 beta4
Mozilla Seamonkey	Version 2.12 beta5
Mozilla Seamonkey	Version 2.12 beta6
Mozilla Seamonkey	Version 2.13.1
Mozilla Seamonkey	Version 2.13.2
Mozilla Seamonkey	Version 2.13
Mozilla Seamonkey	Version 2.13 beta1
Mozilla Seamonkey	Version 2.13 beta2
Mozilla Seamonkey	Version 2.13 beta3
Mozilla Seamonkey	Version 2.13 beta4
Mozilla Seamonkey	Version 2.13 beta5
Mozilla Seamonkey	Version 2.13 beta6
Mozilla Seamonkey	Version 2.14
Mozilla Seamonkey	Version 2.14 beta1
Mozilla Seamonkey	Version 2.14 beta2
Mozilla Seamonkey	Version 2.14 beta3
Mozilla Seamonkey	Version 2.14 beta4
Mozilla Seamonkey	Version 2.14 beta5
Mozilla Seamonkey	Version 2.15.1
Mozilla Seamonkey	Version 2.15.2
Mozilla Seamonkey	Version 2.15
Mozilla Seamonkey	Version 2.15 beta1
Mozilla Seamonkey	Version 2.15 beta2
Mozilla Seamonkey	Version 2.15 beta3
Mozilla Seamonkey	Version 2.15 beta4
Mozilla Seamonkey	Version 2.15 beta5
Mozilla Seamonkey	Version 2.15 beta6
Mozilla Seamonkey	Version 2.16.1
Mozilla Seamonkey	Version 2.16.2
Mozilla Seamonkey	Version 2.16
Mozilla Seamonkey	Version 2.16 beta1
Mozilla Seamonkey	Version 2.16 beta2
Mozilla Seamonkey	Version 2.16 beta3
Mozilla Seamonkey	Version 2.16 beta4
Mozilla Seamonkey	Version 2.16 beta5
Mozilla Seamonkey	Version 2.17.1
Mozilla Seamonkey	Version 2.17
Mozilla Seamonkey	Version 2.17 beta1
Mozilla Seamonkey	Version 2.17 beta2
Mozilla Seamonkey	Version 2.17 beta3
Mozilla Seamonkey	Version 2.17 beta4
Mozilla Seamonkey	Version 2.18 beta1
Mozilla Seamonkey	Version 2.18 beta2
Mozilla Seamonkey	Version 2.18 beta3
Mozilla Seamonkey	Version 2.18 beta4
Mozilla Seamonkey	Version 2.19
Mozilla Seamonkey	Version 2.19 beta1
Mozilla Seamonkey	Version 2.19 beta2
Mozilla Seamonkey	Version 2.1
Mozilla Seamonkey	Version 2.1 alpha1
Mozilla Seamonkey	Version 2.1 alpha2
Mozilla Seamonkey	Version 2.1 alpha3
Mozilla Seamonkey	Version 2.1 beta1
Mozilla Seamonkey	Version 2.1 beta2
Mozilla Seamonkey	Version 2.1 beta3
Mozilla Seamonkey	Version 2.1 rc1
Mozilla Seamonkey	Version 2.1 rc2
Mozilla Seamonkey	Version 2.20
Mozilla Seamonkey	Version 2.20 beta1
Mozilla Seamonkey	Version 2.20 beta2
Mozilla Seamonkey	Version 2.20 beta3
Mozilla Seamonkey	Version 2.21 beta1
Mozilla Seamonkey	Version 2.21 beta2
Mozilla Seamonkey	Version 2.22.1
Mozilla Seamonkey	Version 2.22 beta1
Mozilla Seamonkey	Version 2.22 beta2
Mozilla Seamonkey	Version 2.23
Mozilla Seamonkey	Version 2.23 beta1
Mozilla Seamonkey	Version 2.24
Mozilla Seamonkey	Version 2.24 beta1
Mozilla Seamonkey	Version 2.25
Mozilla Seamonkey	Version 2.25 beta1
Mozilla Seamonkey	Version 2.25 beta2
Mozilla Seamonkey	Version 2.25 beta3
Mozilla Seamonkey	Version 2.26
Mozilla Seamonkey	Version 2.26 rc1
Mozilla Seamonkey	Version 2.2
Mozilla Seamonkey	Version 2.2 beta1
Mozilla Seamonkey	Version 2.2 beta2
Mozilla Seamonkey	Version 2.2 beta3
Mozilla Thunderbird	Up to 24.8.0
Mozilla Thunderbird	Version 31.0
Mozilla Thunderbird	Version 31.1.0
Mozilla Thunderbird	Version 31.1.1

Configuration C

6 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Google Chrome	Up to 37.0.2062.103
Google Chrome	Version 37.0.2062.0
Google Chrome	Version 37.0.2062.100
Google Chrome	Version 37.0.2062.102
Google Chrome	Version 37.0.2062.20
Google Chrome	Version 37.0.2062.3

Running on/with	Platform Versions
Google Chrome Os	All versions

Related CWEs

CWE-310

References (68)

http://googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html

Source: security@mozilla.org

http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html

Source: security@mozilla.org

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698

Source: security@mozilla.org

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00032.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00036.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00039.html

Source: security@mozilla.org

http://rhn.redhat.com/errata/RHSA-2014-1307.html

Source: security@mozilla.org

http://rhn.redhat.com/errata/RHSA-2014-1354.html

Source: security@mozilla.org

http://rhn.redhat.com/errata/RHSA-2014-1371.html

Source: security@mozilla.org

http://secunia.com/advisories/61540

Source: security@mozilla.org

http://secunia.com/advisories/61574

Source: security@mozilla.org

http://secunia.com/advisories/61575

Source: security@mozilla.org

http://secunia.com/advisories/61576

Source: security@mozilla.org

http://secunia.com/advisories/61583

Source: security@mozilla.org

http://www.debian.org/security/2014/dsa-3033

Source: security@mozilla.org

http://www.debian.org/security/2014/dsa-3034

Source: security@mozilla.org

http://www.debian.org/security/2014/dsa-3037

Source: security@mozilla.org

http://www.kb.cert.org/vuls/id/772676

Source: security@mozilla.org

US Government Resource

http://www.mozilla.org/security/announce/2014/mfsa2014-73.html

Source: security@mozilla.org

Vendor Advisory

http://www.novell.com/support/kb/doc.php?id=7015701

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: security@mozilla.org

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: security@mozilla.org

http://www.securityfocus.com/bid/70116

Source: security@mozilla.org

http://www.ubuntu.com/usn/USN-2360-1

Source: security@mozilla.org

http://www.ubuntu.com/usn/USN-2360-2

Source: security@mozilla.org

http://www.ubuntu.com/usn/USN-2361-1

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1064636

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1069405

Source: security@mozilla.org

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/96194

Source: security@mozilla.org

https://security.gentoo.org/glsa/201504-01

Source: security@mozilla.org

http://googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html