1. CVE-Search
  2. CVE-2014-1545
ID CVE-2014-1545
Summary Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions. Per: http://cwe.mitre.org/data/definitions/787.html "CWE-787: Out-of-bounds Write"
References
Vulnerable Configurations
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.1.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.5.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.5.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.6.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.7.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.7:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.7:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.8:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.8:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.9:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.8.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.9:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.5:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.6:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.9.6:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.10:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.1:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.1:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.2:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.2:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.3:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.3:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.4:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.4:*:*:*:*:*:*:*
  • cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.5:*:*:*:*:*:*:*
    cpe:2.3:a:mozilla:netscape_portable_runtime:4.10.5:*:*:*:*:*:*:*
CVSS
Base: 10.0 (as of 28-12-2017 - 02:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:C/I:C/A:C
redhat via4
advisories
  • bugzilla
    id 1174527
    title Segfault in pk12util when using -l option with certain .p12 files
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 7 is installed
        oval oval:com.redhat.rhba:tst:20150364027
      • OR
        • AND
          • comment nspr is earlier than 0:4.10.6-3.el7
            oval oval:com.redhat.rhba:tst:20150364001
          • comment nspr is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364002
        • AND
          • comment nspr-devel is earlier than 0:4.10.6-3.el7
            oval oval:com.redhat.rhba:tst:20150364003
          • comment nspr-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364004
        • AND
          • comment nss is earlier than 0:3.16.2.3-5.el7
            oval oval:com.redhat.rhba:tst:20150364005
          • comment nss is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364006
        • AND
          • comment nss-devel is earlier than 0:3.16.2.3-5.el7
            oval oval:com.redhat.rhba:tst:20150364007
          • comment nss-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364008
        • AND
          • comment nss-pkcs11-devel is earlier than 0:3.16.2.3-5.el7
            oval oval:com.redhat.rhba:tst:20150364009
          • comment nss-pkcs11-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364010
        • AND
          • comment nss-sysinit is earlier than 0:3.16.2.3-5.el7
            oval oval:com.redhat.rhba:tst:20150364011
          • comment nss-sysinit is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364012
        • AND
          • comment nss-tools is earlier than 0:3.16.2.3-5.el7
            oval oval:com.redhat.rhba:tst:20150364013
          • comment nss-tools is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364014
        • AND
          • comment nss-util is earlier than 0:3.16.2.3-2.el7
            oval oval:com.redhat.rhba:tst:20150364015
          • comment nss-util is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364016
        • AND
          • comment nss-util-devel is earlier than 0:3.16.2.3-2.el7
            oval oval:com.redhat.rhba:tst:20150364017
          • comment nss-util-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364018
        • AND
          • comment nss-softokn is earlier than 0:3.16.2.3-9.el7
            oval oval:com.redhat.rhba:tst:20150364019
          • comment nss-softokn is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364020
        • AND
          • comment nss-softokn-devel is earlier than 0:3.16.2.3-9.el7
            oval oval:com.redhat.rhba:tst:20150364021
          • comment nss-softokn-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364022
        • AND
          • comment nss-softokn-freebl is earlier than 0:3.16.2.3-9.el7
            oval oval:com.redhat.rhba:tst:20150364023
          • comment nss-softokn-freebl is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364024
        • AND
          • comment nss-softokn-freebl-devel is earlier than 0:3.16.2.3-9.el7
            oval oval:com.redhat.rhba:tst:20150364025
          • comment nss-softokn-freebl-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364026
    rhsa
    id RHBA-2015:0364
    released 2015-03-05
    severity Moderate
    title RHBA-2015:0364: nss, nss-softokn, nss-util, and nspr bug fix and enhancement update (Moderate)
  • bugzilla
    id 1116198
    title CVE-2014-1544 nss: Race-condition in certificate verification can lead to Remote code execution (MFSA 2014-63)
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 6 is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • comment nspr is earlier than 0:4.10.6-1.el6_5
            oval oval:com.redhat.rhsa:tst:20140917001
          • comment nspr is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364002
        • AND
          • comment nspr-devel is earlier than 0:4.10.6-1.el6_5
            oval oval:com.redhat.rhsa:tst:20140917003
          • comment nspr-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364004
        • AND
          • comment nss-util is earlier than 0:3.16.1-1.el6_5
            oval oval:com.redhat.rhsa:tst:20140917005
          • comment nss-util is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364016
        • AND
          • comment nss-util-devel is earlier than 0:3.16.1-1.el6_5
            oval oval:com.redhat.rhsa:tst:20140917007
          • comment nss-util-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364018
        • AND
          • comment nss is earlier than 0:3.16.1-4.el6_5
            oval oval:com.redhat.rhsa:tst:20140917009
          • comment nss is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364006
        • AND
          • comment nss-devel is earlier than 0:3.16.1-4.el6_5
            oval oval:com.redhat.rhsa:tst:20140917011
          • comment nss-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364008
        • AND
          • comment nss-pkcs11-devel is earlier than 0:3.16.1-4.el6_5
            oval oval:com.redhat.rhsa:tst:20140917013
          • comment nss-pkcs11-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364010
        • AND
          • comment nss-sysinit is earlier than 0:3.16.1-4.el6_5
            oval oval:com.redhat.rhsa:tst:20140917015
          • comment nss-sysinit is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364012
        • AND
          • comment nss-tools is earlier than 0:3.16.1-4.el6_5
            oval oval:com.redhat.rhsa:tst:20140917017
          • comment nss-tools is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20150364014
    rhsa
    id RHSA-2014:0917
    released 2014-07-22
    severity Critical
    title RHSA-2014:0917: nss and nspr security, bug fix, and enhancement update (Critical)
  • bugzilla
    id 1110860
    title Rebase nss in RHEL 5.11 to NSS 3.16.1 (required for FF 31)
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhba:tst:20070331005
      • OR
        • AND
          • comment nss is earlier than 0:3.16.1-2.el5
            oval oval:com.redhat.rhsa:tst:20141246001
          • comment nss is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhba:tst:20150925006
        • AND
          • comment nss-devel is earlier than 0:3.16.1-2.el5
            oval oval:com.redhat.rhsa:tst:20141246003
          • comment nss-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhba:tst:20150925008
        • AND
          • comment nss-pkcs11-devel is earlier than 0:3.16.1-2.el5
            oval oval:com.redhat.rhsa:tst:20141246005
          • comment nss-pkcs11-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhba:tst:20150925010
        • AND
          • comment nss-tools is earlier than 0:3.16.1-2.el5
            oval oval:com.redhat.rhsa:tst:20141246007
          • comment nss-tools is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhba:tst:20150925012
    rhsa
    id RHSA-2014:1246
    released 2014-09-16
    severity Moderate
    title RHSA-2014:1246: nss and nspr security, bug fix, and enhancement update (Moderate)
rpms
  • nspr-0:4.10.6-3.el7
  • nspr-debuginfo-0:4.10.6-3.el7
  • nspr-devel-0:4.10.6-3.el7
  • nss-0:3.16.2.3-5.el7
  • nss-debuginfo-0:3.16.2.3-5.el7
  • nss-devel-0:3.16.2.3-5.el7
  • nss-pkcs11-devel-0:3.16.2.3-5.el7
  • nss-softokn-0:3.16.2.3-9.el7
  • nss-softokn-debuginfo-0:3.16.2.3-9.el7
  • nss-softokn-devel-0:3.16.2.3-9.el7
  • nss-softokn-freebl-0:3.16.2.3-9.el7
  • nss-softokn-freebl-devel-0:3.16.2.3-9.el7
  • nss-sysinit-0:3.16.2.3-5.el7
  • nss-tools-0:3.16.2.3-5.el7
  • nss-util-0:3.16.2.3-2.el7
  • nss-util-debuginfo-0:3.16.2.3-2.el7
  • nss-util-devel-0:3.16.2.3-2.el7
  • nspr-0:4.10.6-1.el6_5
  • nspr-debuginfo-0:4.10.6-1.el6_5
  • nspr-devel-0:4.10.6-1.el6_5
  • nss-0:3.16.1-4.el6_5
  • nss-debuginfo-0:3.16.1-4.el6_5
  • nss-devel-0:3.16.1-4.el6_5
  • nss-pkcs11-devel-0:3.16.1-4.el6_5
  • nss-sysinit-0:3.16.1-4.el6_5
  • nss-tools-0:3.16.1-4.el6_5
  • nss-util-0:3.16.1-1.el6_5
  • nss-util-debuginfo-0:3.16.1-1.el6_5
  • nss-util-devel-0:3.16.1-1.el6_5
  • nss-0:3.16.1-2.el5
  • nss-debuginfo-0:3.16.1-2.el5
  • nss-devel-0:3.16.1-2.el5
  • nss-pkcs11-devel-0:3.16.1-2.el5
  • nss-tools-0:3.16.1-2.el5
refmap via4
bid 67975
confirm
debian
  • DSA-2955
  • DSA-2960
  • DSA-2962
gentoo GLSA-201504-01
sectrack 1030404
secunia
  • 58984
  • 59229
  • 59275
  • 59318
  • 59377
  • 59387
  • 59425
  • 59486
  • 59614
suse
  • SUSE-SU-2014:0824
  • openSUSE-SU-2014:0797
  • openSUSE-SU-2014:0819
  • openSUSE-SU-2014:0855
  • openSUSE-SU-2014:0858
ubuntu USN-2265-1
Last major update 28-12-2017 - 02:29
Published 11-06-2014 - 10:57
Last modified 28-12-2017 - 02:29
Back to Top