Unrated severityNVD Advisory· Published Feb 6, 2014· Updated Jun 17, 2026

CVE-2014-1491

Description

Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Firefox
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Range: <24.3
Mozilla Corporation/Network Security Services2 versions
cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*range: <3.15.4
- (no CPE)range: <3.15.4
Mozilla Corporation/Seamonkey
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
Range: <2.24
Mozilla Corporation/Thunderbird
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Range: <24.3.0
Oracle Corporation/Enterprise Manager Ops Center4 versions
cpe:2.3:a:oracle:enterprise_manager_ops_center:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:oracle:enterprise_manager_ops_center:*:*:*:*:*:*:*:*range: <12.1.4
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.0:*:*:*:*:*:*:*
Oracle Corporation/VM Server
cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:*
Canonical/Ubuntu Linux3 versions
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
OpenSUSE/openSUSE3 versions
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
SUSE S.A./Linux Enterprise Desktop
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
SUSE S.A./Linux Enterprise Server2 versions
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
SUSE S.A./Linux Enterprise Software Development Kit
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*
osv-coords3 versions
pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/mozilla-nss&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/MozillaThunderbird&distro=openSUSE%20Tumbleweed
< 50.1.0-1.1+ 2 more
- (no CPE)range: < 50.1.0-1.1
- (no CPE)range: < 3.26.2-1.1
- (no CPE)range: < 45.5.1-1.1

Patches

Vulnerability mechanics

References

hg.mozilla.org/projects/nss/rev/12c42006aed8nvdPatchVendor Advisory
bugzilla.mozilla.org/show_bug.cginvdExploitIssue TrackingPatchVendor Advisory
kb.juniper.net/InfoCenter/indexnvdThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.htmlnvdThird Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.htmlnvdThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlnvdMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlnvdMailing ListThird Party Advisory
secunia.com/advisories/56858nvdThird Party Advisory
secunia.com/advisories/56888nvdThird Party Advisory
secunia.com/advisories/56922nvdThird Party Advisory
www.debian.org/security/2014/dsa-2858nvdThird Party Advisory
www.debian.org/security/2014/dsa-2994nvdThird Party Advisory
www.mozilla.org/security/announce/2014/mfsa2014-12.htmlnvdThird Party AdvisoryVendor Advisory
www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlnvdThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlnvdThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlnvdThird Party Advisory
www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlnvdThird Party Advisory
www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlnvdThird Party Advisory
www.securityfocus.com/bid/65332nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1029717nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1029720nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1029721nvdThird Party AdvisoryVDB Entry
www.ubuntu.com/usn/USN-2102-1nvdThird Party Advisory
www.ubuntu.com/usn/USN-2102-2nvdThird Party Advisory
www.ubuntu.com/usn/USN-2119-1nvdThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/90886nvdThird Party AdvisoryVDB Entry
security.gentoo.org/glsa/201504-01nvdThird Party Advisory
seclists.org/fulldisclosure/2014/Dec/23nvdNot Applicable
www.securityfocus.com/archive/1/534161/100/0/threadednvdNot Applicable
www.vmware.com/security/advisories/VMSA-2014-0012.htmlnvdNot Applicable

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.004
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000