The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm.
References
| Link | Resource |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html | Mailing List Third Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.html | Mailing List Third Party Advisory |
| http://www.mozilla.org/security/announce/2014/mfsa2014-18.html | Vendor Advisory |
| http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html | Mailing List Third Party Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=935618 | Issue Tracking Vendor Advisory |
| https://security.gentoo.org/glsa/201504-01 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
No history.
Information
Published : 2014-03-19 10:55
Updated : 2024-02-04 18:35
NVD link : CVE-2014-1498
Mitre link : CVE-2014-1498
CVE.ORG link : CVE-2014-1498
JSON object : View
Products Affected
mozilla
- seamonkey
- firefox
opensuse
- opensuse
opensuse_project
- opensuse
suse
- linux_enterprise_server
- linux_enterprise_software_development_kit
- linux_enterprise_desktop
oracle
- solaris
CWE
CWE-347
Improper Verification of Cryptographic Signature