CVE-2014-1568

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-09-25 · updated 2026-06-17
Weakness: CWE-310

Description

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.

Affected products

Google Chrome: through 37.0.2062.120; through 37.0.2062.103; 37.0.2062.0, 37.0.2062.3, 37.0.2062.20, 37.0.2062.100, 37.0.2062.102
Mozilla Firefox: through 32.0; 31.0, 31.1.0, 32.0.1, 32.0.2
Mozilla Firefox ESR: 24.8.0
Mozilla Network Security Services: through 3.16.2.0; 3.2, 3.2.1, 3.3, 3.3.1, 3.3.2, 3.4 (+48)
Mozilla Seamonkey: through 2.29; 1.0, 1.0-alpha, 1.0-beta, 1.0.1, 1.0.2, 1.0.3 (+150)
Mozilla Thunderbird: through 24.8.0; 31.0, 31.1.0, 31.1.1

References

Get alerted when CVE-2014-1568 or the next vulnerability affects your stack