What’s Vulnerable › Vulnerabilities

CVE-2014-1491

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-02-06 · updated 2026-06-17
• Weakness: CWE-326

Description

Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.

Affected products

• Canonical Ubuntu Linux: 12.04, 12.10, 13.10
• Debian Linux: 7.0, 8.0
• Fedoraproject Fedora: 19, 20
• Mozilla Firefox: before 24.3; before 27.0 — fixed in 24.3, 27.0
• Mozilla Network Security Services: before 3.15.4 — fixed in 3.15.4
• Mozilla Seamonkey: before 2.24 — fixed in 2.24
• Mozilla Thunderbird: before 24.3.0 — fixed in 24.3.0
• Opensuse: 11.4, 12.3, 13.1
• Oracle Corporation Enterprise Manager Ops Center: before 12.1.4; 12.2.0, 12.2.1, 12.3.0 — fixed in 12.1.4
• Oracle Vm Server: 3.2
• SUSE Linux Enterprise Server 15 SP1: 11-sp3
• SUSE Linux Enterprise Server: 11-sp3
• SUSE Linux Enterprise Software Development Kit: 11-sp3

How to fix

Upgrade to a fixed version: Mozilla Firefox 24.3, 27.0; Mozilla Network Security Services 3.15.4; Mozilla Seamonkey 2.24; Mozilla Thunderbird 24.3.0; Oracle Corporation Enterprise Manager Ops Center 12.1.4. Check the vendor advisory for mitigations.

References

• http://hg.mozilla.org/projects/nss/rev/12c42006aed8
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
• http://seclists.org/fulldisclosure/2014/Dec/23
• http://secunia.com/advisories/56858
• http://secunia.com/advisories/56888
• http://secunia.com/advisories/56922

Get alerted when CVE-2014-1491 or the next vulnerability affects your stack