p PatchFirst

CVE-2014-1492

CVE-2014-1492

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

EPSS 1.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • nss Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:3.16-1

    Update to 2:3.16-1

  • nss Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:3.16-1

    Update to 2:3.16-1

  • nss Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:3.16-1

    Update to 2:3.16-1

  • firefox Ubuntu:14.04:LTS

    Versions
    • 24.0+build1-0ubuntu1
    • 25.0+build3-0ubuntu0.13.10.1
    • 28.0~b2+build1-0ubuntu2
    • 28.0+build1-0ubuntu1
    • 28.0+build2-0ubuntu1
    • 28.0+build2-0ubuntu2
    Affected ranges
    • ECOSYSTEM: < 29.0+build1-0ubuntu0.14.04.2

    Update to 29.0+build1-0ubuntu0.14.04.2

  • nss Ubuntu:14.04:LTS

    Versions
    • 2:3.15.1-1ubuntu1
    • 2:3.15.2-1
    • 2:3.15.3-1
    • 2:3.15.3.1-1
    • 2:3.15.3.1-1.1
    • 2:3.15.3.1-1.1ubuntu1
    • 2:3.15.4-1ubuntu3
    • 2:3.15.4-1ubuntu4
    • 2:3.15.4-1ubuntu5
    • 2:3.15.4-1ubuntu6
    Affected ranges
    • ECOSYSTEM: < 2:3.15.4-1ubuntu7

    Update to 2:3.15.4-1ubuntu7

Original sources

Check your server →