CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
AI Score
Confidence
Low
EPSS
Percentile
91.9%
Package : nss
Version : 3.12.8-1+squeeze9
CVE ID : CVE-2014-1568
Antoine Delignat-Lavaud from Inria discovered an issue in the way NSS
(the Mozilla Network Security Service library) was parsing ASN.1 data
used in signatures, making it vulnerable to a signature forgery attack.
An attacker could craft ASN.1 data to forge RSA certificates with a
valid certification chain to a trusted CA.
This update fixes this issue for the NSS libraries.
Note that iceweasel, which is also affected by CVE-2014-1568, however
has reached end-of-life in Squeeze(-LTS) and thus has not been fixed.
Attachment:
signature.asc
Description: This is a digitally signed message part.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 7 | i386 | libmozjs24d | < 24.8.1esr-1~deb7u1 | libmozjs24d_24.8.1esr-1~deb7u1_i386.deb |
Debian | 7 | armel | libnss3-dev | < 2:3.14.5-1+deb7u2 | libnss3-dev_2:3.14.5-1+deb7u2_armel.deb |
Debian | 7 | kfreebsd-amd64 | iceweasel-dbg | < 24.8.1esr-1~deb7u1 | iceweasel-dbg_24.8.1esr-1~deb7u1_kfreebsd-amd64.deb |
Debian | 7 | all | iceweasel-l10n-ja | < 1:24.8.1esr-1~deb7u1 | iceweasel-l10n-ja_1:24.8.1esr-1~deb7u1_all.deb |
Debian | 7 | armel | xulrunner-dev | < 24.8.1esr-1~deb7u1 | xulrunner-dev_24.8.1esr-1~deb7u1_armel.deb |
Debian | 6 | i386 | libnss3-1d | < 3.12.8-1+squeeze9 | libnss3-1d_3.12.8-1+squeeze9_i386.deb |
Debian | 7 | s390 | iceweasel-dbg | < 24.8.1esr-1~deb7u1 | iceweasel-dbg_24.8.1esr-1~deb7u1_s390.deb |
Debian | 7 | kfreebsd-amd64 | iceweasel | < 24.8.1esr-1~deb7u1 | iceweasel_24.8.1esr-1~deb7u1_kfreebsd-amd64.deb |
Debian | 7 | all | iceweasel-l10n-hy-am | < 1:24.8.1esr-1~deb7u1 | iceweasel-l10n-hy-am_1:24.8.1esr-1~deb7u1_all.deb |
Debian | 7 | mips | libnss3 | < 2:3.14.5-1+deb7u2 | libnss3_2:3.14.5-1+deb7u2_mips.deb |