What’s Vulnerable › Vulnerabilities

CVE-2014-1490

• Severity: critical (CVSS 9.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-02-06 · updated 2026-06-17
• Weakness: CWE-362

Description

Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.

Affected products

• Canonical Ubuntu Linux: 12.04, 12.10, 13.10
• Debian Linux: 7.0
• Fedoraproject Fedora: 19, 20
• Mozilla Firefox: before 24.3; before 27.0 — fixed in 24.3, 27.0
• Mozilla Network Security Services: before 3.15.4 — fixed in 3.15.4
• Mozilla Seamonkey: before 2.24 — fixed in 2.24
• Mozilla Thunderbird: before 24.3.0 — fixed in 24.3.0
• Opensuse: 11.4, 12.3, 13.1
• Oracle Corporation Enterprise Manager Ops Center: before 12.1.4; 12.2.0, 12.2.1, 12.3.0 — fixed in 12.1.4
• Oracle Vm Server: 3.2
• SUSE Linux Enterprise Server 15 SP1: 11-sp3
• SUSE Linux Enterprise Server: 11-sp3
• SUSE Linux Enterprise Software Development Kit: 11-sp3

How to fix

Upgrade to a fixed version: Mozilla Firefox 24.3, 27.0; Mozilla Network Security Services 3.15.4; Mozilla Seamonkey 2.24; Mozilla Thunderbird 24.3.0; Oracle Corporation Enterprise Manager Ops Center 12.1.4. Check the vendor advisory for mitigations.

References

• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
• http://osvdb.org/102876
• http://seclists.org/fulldisclosure/2014/Dec/23
• http://secunia.com/advisories/56706
• http://secunia.com/advisories/56767
• http://secunia.com/advisories/56787

Get alerted when CVE-2014-1490 or the next vulnerability affects your stack