CVE-2014-1490

Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 81%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
< 24.3
mozillafirefox
𝑥
< 27.0
mozillanetwork_security_services
𝑥
< 3.15.4
mozillaseamonkey
𝑥
< 2.24
mozillathunderbird
𝑥
< 24.3.0
oracleenterprise_manager_ops_center
𝑥
< 12.1.4
oracleenterprise_manager_ops_center
12.2.0
oracleenterprise_manager_ops_center
12.2.1
oracleenterprise_manager_ops_center
12.3.0
oraclevm_server
3.2
opensuseopensuse
11.4
opensuseopensuse
12.3
opensuseopensuse
13.1
debiandebian_linux
7.0
canonicalubuntu_linux
12.04
canonicalubuntu_linux
12.10
canonicalubuntu_linux
13.10
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nss
bookworm
2:3.87.1-1
fixed
bullseye
2:3.61-1+deb11u3
fixed
bullseye (security)
2:3.61-1+deb11u4
fixed
sid
2:3.105-2
fixed
squeeze
no-dsa
trixie
2:3.105-2
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
lucid
ignored
precise
Fixed 27.0+build1-0ubuntu0.12.04.1
released
quantal
Fixed 27.0+build1-0ubuntu0.12.10.1
released
saucy
Fixed 27.0+build1-0ubuntu0.13.10.1
released
nss
lucid
not-affected
precise
not-affected
quantal
not-affected
saucy
not-affected
thunderbird
lucid
ignored
precise
Fixed 1:24.3.0+build2-0ubuntu0.12.04.1
released
quantal
Fixed 1:24.3.0+build2-0ubuntu0.12.10.1
released
saucy
Fixed 1:24.3.0+build2-0ubuntu0.13.10.1
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
MozillaFirefox
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-devel
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-translations-common
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 12 SP5
68.1.0-109.92.1
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 12 SP5
68.1.0-109.92.1
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaFirefox-translations-other
suse enterprise desktop 15
52.7.3-1.35
fixed
suse enterprise sap 15
52.7.3-1.35
fixed
suse enterprise server 15
52.7.3-1.35
fixed
MozillaThunderbird
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
MozillaThunderbird-devel
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise workstation 15
52.8-1.2
fixed
MozillaThunderbird-translations-common
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
MozillaThunderbird-translations-other
suse enterprise desktop 15
52.8-1.2
fixed
suse enterprise desktop 15 SP1
60.6.1-3.28.1
fixed
suse enterprise sap 15
52.8-1.2
fixed
suse enterprise sap 15 SP1
60.6.1-3.28.1
fixed
suse enterprise server 15
52.8-1.2
fixed
suse enterprise server 15 SP1
60.6.1-3.28.1
fixed
suse enterprise workstation 15
52.8-1.2
fixed
suse enterprise workstation 15 SP1
60.6.1-3.28.1
fixed
libfreebl3
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
libfreebl3-32bit
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
libfreebl3-hmac
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
libsoftokn3
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
libsoftokn3-32bit
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
libsoftokn3-hmac
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
mozilla-nss
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
mozilla-nss-32bit
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
mozilla-nss-certs
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
mozilla-nss-certs-32bit
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
mozilla-nss-devel
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
mozilla-nss-sysinit
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
mozilla-nss-tools
suse enterprise desktop 15
3.36.1-1.7
fixed
suse enterprise desktop 15 SP1
3.41.1-3.13.1
fixed
suse enterprise sap 15
3.36.1-1.7
fixed
suse enterprise sap 15 SP1
3.41.1-3.13.1
fixed
suse enterprise server 15
3.36.1-1.7
fixed
suse enterprise server 15 SP1
3.41.1-3.13.1
fixed
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
nspr
RHEL 6
0:4.10.6-1.el6_5
fixed
nspr-devel
RHEL 6
0:4.10.6-1.el6_5
fixed
nss
RHEL 6
0:3.16.1-4.el6_5
fixed
nss-devel
RHEL 6
0:3.16.1-4.el6_5
fixed
nss-pkcs11-devel
RHEL 6
0:3.16.1-4.el6_5
fixed
nss-sysinit
RHEL 6
0:3.16.1-4.el6_5
fixed
nss-tools
RHEL 6
0:3.16.1-4.el6_5
fixed
nss-util
RHEL 6
0:3.16.1-1.el6_5
fixed
nss-util-devel
RHEL 6
0:3.16.1-1.el6_5
fixed
Common Weakness Enumeration
References
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
http://osvdb.org/102876
http://seclists.org/fulldisclosure/2014/Dec/23
http://secunia.com/advisories/56706
http://secunia.com/advisories/56767
http://secunia.com/advisories/56787
http://secunia.com/advisories/56858
http://secunia.com/advisories/56888
http://secunia.com/advisories/56922
http://www.debian.org/security/2014/dsa-2858
http://www.mozilla.org/security/announce/2014/mfsa2014-12.html
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/archive/1/534161/100/0/threaded
http://www.securityfocus.com/bid/65335
http://www.securitytracker.com/id/1029717
http://www.securitytracker.com/id/1029720
http://www.securitytracker.com/id/1029721
http://www.ubuntu.com/usn/USN-2102-1
http://www.ubuntu.com/usn/USN-2102-2
http://www.ubuntu.com/usn/USN-2119-1
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
https://8pecxstudios.com/?page_id=44080
https://bugzilla.mozilla.org/show_bug.cgi?id=930857
https://bugzilla.mozilla.org/show_bug.cgi?id=930874
https://exchange.xforce.ibmcloud.com/vulnerabilities/90885
https://security.gentoo.org/glsa/201504-01
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
http://osvdb.org/102876
http://seclists.org/fulldisclosure/2014/Dec/23
http://secunia.com/advisories/56706
http://secunia.com/advisories/56767
http://secunia.com/advisories/56787
http://secunia.com/advisories/56858
http://secunia.com/advisories/56888
http://secunia.com/advisories/56922
http://www.debian.org/security/2014/dsa-2858
http://www.mozilla.org/security/announce/2014/mfsa2014-12.html
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html
http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/archive/1/534161/100/0/threaded
http://www.securityfocus.com/bid/65335
http://www.securitytracker.com/id/1029717
http://www.securitytracker.com/id/1029720
http://www.securitytracker.com/id/1029721
http://www.ubuntu.com/usn/USN-2102-1
http://www.ubuntu.com/usn/USN-2102-2
http://www.ubuntu.com/usn/USN-2119-1
http://www.vmware.com/security/advisories/VMSA-2014-0012.html
https://8pecxstudios.com/?page_id=44080
https://bugzilla.mozilla.org/show_bug.cgi?id=930857
https://bugzilla.mozilla.org/show_bug.cgi?id=930874
https://exchange.xforce.ibmcloud.com/vulnerabilities/90885
https://security.gentoo.org/glsa/201504-01