HIGH
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.
http://secunia.com/advisories/59591
http://secunia.com/advisories/59719
http://secunia.com/advisories/59760
http://secunia.com/advisories/60083
http://secunia.com/advisories/60486
http://secunia.com/advisories/60621
http://secunia.com/advisories/60628
http://www.debian.org/security/2014/dsa-2986
http://www.debian.org/security/2014/dsa-2996
http://www.mozilla.org/security/announce/2014/mfsa2014-63.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.securityfocus.com/bid/68816
http://www.securitytracker.com/id/1030617
Source: MITRE
Published: 2014-07-23
Updated: 2017-01-07
Type: NVD-CWE-Other
Base Score: 10
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Impact Score: 10
Exploitability Score: 10
Severity: HIGH
OR
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* versions up to 30.0 (inclusive)
cpe:2.3:a:mozilla:firefox_esr:24.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.1.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.3.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.4.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.4.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.6.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.7.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.7.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.7.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.7.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.7.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.11.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.11.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.11.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.11.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.3.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.12.11:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.14:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.14.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.14.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.14.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.14.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.14.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.15:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.15.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.15.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.15.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.15.3.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.15.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.15.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:network_security_services:3.16:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:24.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:24.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:24.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:24.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:24.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:24.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:24.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:24.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* versions up to 24.6 (inclusive)
ID | Name | Product | Family | Severity |
---|---|---|---|---|
701246 | Mozilla Firefox ESR < 24.7 Multiple Vulnerabilities | Nessus Network Monitor | Web Clients | high |
701240 | Mozilla Firefox ESR < 24.7 Multiple Vulnerabilities | Nessus Network Monitor | Web Clients | high |
91202 | F5 Networks BIG-IP : Multiple Mozilla NSS vulnerabilities (K16716) | Nessus | F5 Networks Local Security Checks | critical |
82632 | GLSA-201504-01 : Mozilla Products: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | critical |
82234 | Debian DLA-89-1 : nss security update | Nessus | Debian Local Security Checks | critical |
81942 | Mandriva Linux Security Advisory : nss (MDVSA-2015:059) | Nessus | Mandriva Local Security Checks | critical |
80610 | Oracle Solaris Third-Party Patch Update : firefox (multiple_vulnerabilities_fixed_in_firefox1) | Nessus | Solaris Local Security Checks | critical |
79190 | Debian DSA-3071-1 : nss - security update | Nessus | Debian Local Security Checks | critical |
79110 | RHEL 5 / 6 : nss (RHSA-2014:0915) | Nessus | Red Hat Local Security Checks | critical |
79047 | RHEL 4 : nss (RHSA-2014:1165) | Nessus | Red Hat Local Security Checks | critical |
78328 | Amazon Linux AMI : nss (ALAS-2014-385) | Nessus | Amazon Linux Local Security Checks | critical |
77601 | Ubuntu 10.04 LTS / 12.04 LTS / 14.04 LTS : nss vulnerability (USN-2343-1) | Nessus | Ubuntu Local Security Checks | critical |
77131 | openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2014:0976-1) | Nessus | SuSE Local Security Checks | critical |
76990 | SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 9569) | Nessus | SuSE Local Security Checks | critical |
76989 | SuSE 11.3 Security Update : Mozilla Firefox (SAT Patch Number 9569) | Nessus | SuSE Local Security Checks | critical |
76977 | Debian DSA-2996-1 : icedove - security update | Nessus | Debian Local Security Checks | critical |
76959 | openSUSE Security Update : MozillaFirefox (openSUSE-2014-476) | Nessus | SuSE Local Security Checks | critical |
76885 | Mandriva Linux Security Advisory : nss (MDVSA-2014:139) | Nessus | Mandriva Local Security Checks | critical |
76841 | Debian DSA-2986-1 : iceweasel - security update | Nessus | Debian Local Security Checks | critical |
8339 | Mozilla Thunderbird < 31.0 Multiple Vulnerabilities | Nessus Network Monitor | SMTP Clients | high |
8333 | Mozilla Firefox < 31.0 Multiple Vulnerabilities | Nessus Network Monitor | Web Clients | high |
76765 | Mozilla Thunderbird < 31.0 Multiple Vulnerabilities | Nessus | Windows | critical |
76764 | Mozilla Thunderbird 24.x < 24.7 Multiple Vulnerabilities | Nessus | Windows | critical |
76763 | Firefox < 31.0 Multiple Vulnerabilities | Nessus | Windows | critical |
76762 | Firefox ESR 24.x < 24.7 Multiple Vulnerabilities | Nessus | Windows | critical |
76761 | Mozilla Thunderbird < 31.0 Multiple Vulnerabilities (Mac OS X) | Nessus | MacOS X Local Security Checks | critical |
76760 | Mozilla Thunderbird 24.x < 24.7 Multiple Vulnerabilities (Mac OS X) | Nessus | MacOS X Local Security Checks | critical |
76759 | Firefox < 31.0 Multiple Vulnerabilities (Mac OS X) | Nessus | MacOS X Local Security Checks | critical |
76758 | Firefox ESR 24.x< 24.7 Multiple Vulnerabilities (Mac OS X) | Nessus | MacOS X Local Security Checks | critical |
76742 | Oracle Linux 5 / 7 : nspr / nss (ELSA-2014-0916) | Nessus | Oracle Linux Local Security Checks | critical |
76720 | FreeBSD : mozilla -- multiple vulnerabilities (978b0f76-122d-11e4-afe3-bc5ff4fb5e7b) | Nessus | FreeBSD Local Security Checks | critical |
76706 | Ubuntu 12.04 LTS / 14.04 LTS : thunderbird vulnerabilities (USN-2296-1) | Nessus | Ubuntu Local Security Checks | critical |
76705 | Ubuntu 12.04 LTS / 14.04 LTS : firefox vulnerabilities (USN-2295-1) | Nessus | Ubuntu Local Security Checks | critical |
76702 | Scientific Linux Security Update : nss and nspr on SL6.x i386/x86_64 (20140722) | Nessus | Scientific Linux Local Security Checks | critical |
76701 | Scientific Linux Security Update : nss and nspr on SL5.x i386/x86_64 (20140722) | Nessus | Scientific Linux Local Security Checks | critical |
76698 | RHEL 6 : nss and nspr (RHSA-2014:0917) | Nessus | Red Hat Local Security Checks | critical |
76697 | RHEL 5 / 7 : nss and nspr (RHSA-2014:0916) | Nessus | Red Hat Local Security Checks | critical |
76694 | Oracle Linux 6 : nspr / nss (ELSA-2014-0917) | Nessus | Oracle Linux Local Security Checks | critical |
76686 | CentOS 6 : nspr / nss / nss-util (CESA-2014:0917) | Nessus | CentOS Local Security Checks | critical |
76685 | CentOS 5 / 7 : nspr / nss (CESA-2014:0916) | Nessus | CentOS Local Security Checks | critical |