CVE-2014-1544

Firefox < 30.0 and Firefox ESR < 24.7 - Remote Code Execution via Use-After-Free in CERT_DestroyCertificate

Title source: llm
STIX 2.1

Description

Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.

References (16)

Core 16
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59719
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60083
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/68816
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60621
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201504-01
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1030617
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2996
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=963150
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60486
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60628
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2986
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59760
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59591

Scores

EPSS 0.0325
EPSS Percentile 87.3%

Details

Status published
Products (50)
mozilla/firefox 24.0
mozilla/firefox 24.0.1
mozilla/firefox 24.0.2
mozilla/firefox 24.1.0
mozilla/firefox 24.1.1
mozilla/firefox < 30.0
mozilla/firefox_esr 24.2
mozilla/firefox_esr 24.3
mozilla/firefox_esr 24.4
mozilla/firefox_esr 24.5
... and 40 more
Published Jul 23, 2014
Tracked Since Feb 18, 2026