CVE-2014-1490
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in...
9.3 HighFix available
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
Exploit likelihood
3.90%Down 0.5 points since Feb 4, 2022
What each source reports
NVD Score used
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
- Record
CVE-2014-1490- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
- Record
CVE-2014-1490- Updated
- 2026-11-02
EUVDEUVD-2014-1566 No score
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
- Record
EUVD-2014-1566- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-68r6-xqmg-xhxx No score
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in...
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
- Record
GHSA-68r6-xqmg-xhxx- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV No score
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
- Record
CVE-2014-1490- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-1490 No score
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
- Record
DEBIAN-CVE-2014-1490- Updated
- 2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score
MozillaThunderbird-45.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10230-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10451-1 No score
libfreebl3-3.26.2-1.1 on GA media
These are all security issues fixed in the libfreebl3-3.26.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10451-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
- mozilla firefox
- mozilla network security services
- mozilla seamonkey
- mozilla thunderbird
- canonical ubuntu linux
- debian linux
- fedoraproject fedora
- opensuse
- oracle enterprise manager ops center
- oracle vm server
- suse linux enterprise desktop
- suse linux enterprise server
Show 1 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nssDebian:12 |
before 2:3.15.4-1 | 2:3.15.4-1 |
nssDebian:13 |
before 2:3.15.4-1 | 2:3.15.4-1 |
nssDebian:14 |
before 2:3.15.4-1 | 2:3.15.4-1 |
iceweaselDebian:7 From an advisory covering 8 CVEs |
before 24.3.0esr-1~deb7u1, plus listed versions 10.0.12esr-110.0.12esr-1+alpha10.0.12esr-1+nmu110.0.12esr-1+nmu1+alpha11.0-1 Show 45 moreShow less11.0-211.0-311.0-411.0~b1-111.0~b1-211.0~b2-111.0~b3-111.0~b4-111.0~b5-111.0~b6-112.0-112.0-212.0-312.0-412.0-512.0-612.0-713.0-113.0.1-113.0.1-214.0.1-114.0.1-215.0-115.0.1-116.0-116.0.1-116.0.2-117.0-117.0.1-117.0.1-217.0.10esr-1~deb7u117.0.5esr-117.0.6esr-117.0.6esr-1~deb7u117.0.7esr-117.0.7esr-1~deb7u117.0.7esr-217.0.8esr-117.0.8esr-1~deb7u117.0.8esr-217.0.8esr-2~deb7u117.0.9esr-1~deb7u118.0-118.0.1-118.0.2-1 |
24.3.0esr-1~deb7u1 |
nsprRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nspr-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nssRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-sysinitRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-toolsRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
Show 58 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nss-utilRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nss-util-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nspr-develRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nss-develRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-pkcs11-develRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-util-develRed Hat:enterprise_linux:6::client From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nsprRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nspr-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nssRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-sysinitRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-toolsRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-utilRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nss-util-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nspr-develRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nss-develRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-pkcs11-develRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-util-develRed Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nsprRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nspr-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nspr-develRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nssRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-develRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-sysinitRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-toolsRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-utilRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nss-util-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nss-util-develRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nss-pkcs11-develRed Hat:enterprise_linux:6::server From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nsprRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nspr-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nspr-develRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:4.10.6-1.el6_5 | 0:4.10.6-1.el6_5 |
nssRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-develRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-sysinitRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-toolsRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nss-utilRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nss-util-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nss-util-develRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:3.16.1-1.el6_5 | 0:3.16.1-1.el6_5 |
nss-pkcs11-develRed Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs |
before 0:3.16.1-4.el6_5 | 0:3.16.1-4.el6_5 |
nssRed Hat:enterprise_linux:5::client_workstation From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nss-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nss-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nss-pkcs11-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nssRed Hat:enterprise_linux:5::client From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nss-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nss-toolsRed Hat:enterprise_linux:5::client From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nssRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nss-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nss-develRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nss-pkcs11-develRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
nss-toolsRed Hat:enterprise_linux:5::server From an advisory covering 5 CVEs |
before 0:3.16.1-2.el5 | 0:3.16.1-2.el5 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 899 CVEs |
before 50.1.0-1.1 | 50.1.0-1.1 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 560 CVEs |
before 45.5.1-1.1 | 45.5.1-1.1 |
mozilla-nssopenSUSE:Tumbleweed From an advisory covering 22 CVEs |
before 3.26.2-1.1 | 3.26.2-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1490 is a high vulnerability (CVSS 9.3) in Mozilla Firefox, published February 6, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.90%, the 90th percentile. Fixed in nss 2:3.15.4-1.
References
ubuntu.com/usn/USN-2119-1
oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
securityfocus.com/bid/65335
securitytracker.com/id/1029721
lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
Show 194 moreShow less
vmware.com/security/advisories/VMSA-2014-0012.html
8pecxstudios.com?page_id=44080
secunia.com/advisories/56922
osvdb.org/102876
debian.org/security/2014/dsa-2858
bugzilla.mozilla.org/show_bug.cgi?id=930874
security.gentoo.org/glsa/201504-01
mozilla.org/security/announce/2014/mfsa2014-12.html
kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
seclists.org/fulldisclosure/2014/Dec/23
lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
exchange.xforce.ibmcloud.com/vulnerabilities/90885
nvd.nist.gov/vuln/detail/CVE-2014-1490
github.com/advisories/GHSA-68r6-xqmg-xhxx
security-tracker.debian.org/tracker/CVE-2014-1490
access.redhat.com/errata/RHSA-2014:0917
bugzilla.redhat.com/show_bug.cgi?id=1053725
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0917.json
cve.org/CVERecord?id=CVE-2013-1740
suse.com/security/cve/CVE-2008-5913
This page doesn't list everything
Left out here: 18 versions and 1,982 references. The JSON record has them.