CVE-2014-1492: mozilla network_security_services Improper Input Validation

CVSS: 4.3v2.0MediumModified

AliasesRHSA-2014:1073UBUNTU-CVE-2014-1492DEBIAN-CVE-2014-1492

Published 25-03-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-1492 is a medium (CVSS 4.3) Improper Input Validation vulnerability in mozilla network_security_services. EPSS estimates a 1.77% chance of exploitation in the next 30 days, higher than 77.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

1.77%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 9 · Related 4

DLA-23-1 DSA-2994-1 MGASA-2014-0137 OPENSUSE-SU-2024:10071-1 OPENSUSE-SU-2024:10451-1 OPENSUSE-SU-2024:14572-1+3 more

Timeline

25-03-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

1.77%

Chance of exploitation in the next 30 days

Percentile

78%

Versus all other CVEs

30-day change

0.00 pp

From 1.77% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.77%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (hg.mozilla.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Redhat14 products

nss< 0:3.16.2-2.el7_0
nss-debuginfo< 0:3.16.2-2.el7_0
nss-devel< 0:3.16.2-2.el7_0
nss-pkcs11-devel< 0:3.16.2-2.el7_0
nss-softokn< 0:3.16.2-1.el7_0

Show all 14

Ubuntu2 products

firefox< 29.0+build1-0ubuntu0.14.04.2
nss< 2:3.15.4-1ubuntu7

Debian1 product

nss< 2:3.16-1

Mozilla1 product

network_security_services≤ 3.15.5 | 3.2 | 3.21 | 3.3 | 3.3.1 | 3.3.2 | 3.4 | 3.4.1 | 3.4.2 | 3.5 | 3.6 | 3.6.1 | 3.7 | 3.7.1 | 3.7.2 | 3.7.3 | 3.7.5 | 3.7.7 | 3.8 | 3.9 | 3.11.2 | 3.11.3 | 3.11.4 | 3.11.5 | 3.12 | 3.12.1 | 3.12.2 | 3.12.3 | 3.12.3.1 | 3.12.3.2 | 3.12.4 | 3.12.5 | 3.12.6 | 3.12.7 | 3.12.8 | 3.12.9 | 3.12.10 | 3.12.11 | 3.14 | 3.14.1 | 3.14.2 | 3.14.3 | 3.14.4 | 3.14.5 | 3.15 | 3.15.1 | 3.15.2 | 3.15.3 | 3.15.3.1 | 3.15.4

4 vendors · 18 products