CVE-2014-1568 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2014-1568

CVE-2014-1568

Published:September 25, 2014

Updated:May 17, 2026

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.

Related Resources (37)

http://www.novell.com/support/kb/doc.php?id=7015701

http://googlechromereleases.blogspot.com/2014/09/stable-channel-update_24.html

https://bugzilla.mozilla.org/show_bug.cgi?id=1069405

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00039.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://rhn.redhat.com/errata/RHSA-2014-1307.html

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761

http://www.debian.org/security/2014/dsa-3037

http://www.debian.org/security/2014/dsa-3033

http://secunia.com/advisories/61574

https://people.canonical.com/~ubuntu-security/cve/CVE-2014-1568

https://security.gentoo.org/glsa/201504-01

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

http://rhn.redhat.com/errata/RHSA-2014-1371.html

http://www.kb.cert.org/vuls/id/772676

http://www.ubuntu.com/usn/USN-2360-1

http://www.ubuntu.com/usn/USN-2361-1

http://secunia.com/advisories/61540

https://exchange.xforce.ibmcloud.com/vulnerabilities/96194

http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html

http://www.debian.org/security/2014/dsa-3034

http://rhn.redhat.com/errata/RHSA-2014-1354.html

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00032.html

https://access.redhat.com/security/cve/CVE-2014-1568

http://secunia.com/advisories/61583

http://googlechromereleases.blogspot.com/2014/09/stable-channel-update-for-chrome-os_24.html

https://security-tracker.debian.org/tracker/CVE-2014-1568

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698

http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00036.html

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

http://secunia.com/advisories/61575

http://www.mozilla.org/security/announce/2014/mfsa2014-73.html

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.ubuntu.com/usn/USN-2360-2

http://secunia.com/advisories/61576

http://www.securityfocus.com/bid/70116

https://bugzilla.mozilla.org/show_bug.cgi?id=1064636

Do you need more information?

CVSS v3

Base Score:

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

LOW

CVSS v2

Base Score:

7.5

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

EPSS

Base Score:

33.60