Vulnerability-Lookup

CVE-2014-1584 (GCVE-0-2014-1584)

Vulnerability from cvelistv5 – Published: 2014-10-15 10:00 – Updated: 2024-08-06 09:42

Summary

The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.

Severity

No CVSS data available.

CWE

Assigner

mozilla mitre root

References

13 references

URL	Tags
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.mozilla.org/security/announce/2014/mfs…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1031028	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/70434	vdb-entryx_refsource_BID
https://security.gentoo.org/glsa/201504-01	vendor-advisoryx_refsource_GENTOO
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://bugzilla.mozilla.org/show_bug.cgi?id=1066190	x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.ubuntu.com/usn/USN-2372-1	vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/62022	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/62023	third-party-advisoryx_refsource_SECUNIA

Date Public

2014-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:42:36.662Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2014:1344",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
          },
          {
            "name": "FEDORA-2014-13042",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html"
          },
          {
            "name": "1031028",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031028"
          },
          {
            "name": "openSUSE-SU-2014:1345",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
          },
          {
            "name": "70434",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70434"
          },
          {
            "name": "GLSA-201504-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201504-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190"
          },
          {
            "name": "FEDORA-2014-14084",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
          },
          {
            "name": "USN-2372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2372-1"
          },
          {
            "name": "62022",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62022"
          },
          {
            "name": "62023",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62023"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-20T16:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "openSUSE-SU-2014:1344",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
        },
        {
          "name": "FEDORA-2014-13042",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html"
        },
        {
          "name": "1031028",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031028"
        },
        {
          "name": "openSUSE-SU-2014:1345",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
        },
        {
          "name": "70434",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70434"
        },
        {
          "name": "GLSA-201504-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201504-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190"
        },
        {
          "name": "FEDORA-2014-14084",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
        },
        {
          "name": "USN-2372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2372-1"
        },
        {
          "name": "62022",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62022"
        },
        {
          "name": "62023",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62023"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2014-1584",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2014:1344",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
            },
            {
              "name": "FEDORA-2014-13042",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html"
            },
            {
              "name": "1031028",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031028"
            },
            {
              "name": "openSUSE-SU-2014:1345",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
            },
            {
              "name": "70434",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70434"
            },
            {
              "name": "GLSA-201504-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201504-01"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190"
            },
            {
              "name": "FEDORA-2014-14084",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
            },
            {
              "name": "USN-2372-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2372-1"
            },
            {
              "name": "62022",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62022"
            },
            {
              "name": "62023",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62023"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2014-1584",
    "datePublished": "2014-10-15T10:00:00.000Z",
    "dateReserved": "2014-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:42:36.662Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-1584",
      "date": "2026-09-14",
      "epss": "0.02143",
      "percentile": "0.81044"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"32.0\", \"matchCriteriaId\": \"97A0B769-5287-4E95-874B-F1D7FC41C7AF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:30.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"38EBC9E7-46AD-4DCD-AA7B-5071F55E3755\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11F024A-A8B7-405B-8A13-4BF406FBDB22\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:mozilla:firefox:31.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D81A3698-797C-4CD9-BB02-A9182E0A6E11\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.\"}, {\"lang\": \"es\", \"value\": \"La implementaci\\u00f3n Public Key Pinning (PKP) en Mozilla Firefox anterior a 33.0 salta las comprobaciones de fijaci\\u00f3n (pinning) al encontrar un error no especificado de la verificaci\\u00f3n de emisor, lo que facilita a atacantes remotos evadir la configuraci\\u00f3n de fijaci\\u00f3n (pinning) y suplantar un sitio web a trav\\u00e9s de un certificado manipulado que conlleva a la presentaci\\u00f3n del dialogo de conexi\\u00f3n no confiable con el usuario.\"}]",
      "id": "CVE-2014-1584",
      "lastModified": "2024-11-21T02:04:39.620",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2014-10-15T10:55:06.990",
      "references": "[{\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://secunia.com/advisories/62022\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://secunia.com/advisories/62023\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://www.mozilla.org/security/announce/2014/mfsa2014-80.html\", \"source\": \"security@mozilla.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://www.securityfocus.com/bid/70434\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://www.securitytracker.com/id/1031028\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-2372-1\", \"source\": \"security@mozilla.org\"}, {\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1066190\", \"source\": \"security@mozilla.org\"}, {\"url\": \"https://security.gentoo.org/glsa/201504-01\", \"source\": \"security@mozilla.org\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/62022\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/62023\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.mozilla.org/security/announce/2014/mfsa2014-80.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/70434\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securitytracker.com/id/1031028\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.ubuntu.com/usn/USN-2372-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=1066190\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/201504-01\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@mozilla.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-310\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-1584\",\"sourceIdentifier\":\"security@mozilla.org\",\"published\":\"2014-10-15T10:55:06.990\",\"lastModified\":\"2026-05-06T22:30:45.220\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.\"},{\"lang\":\"es\",\"value\":\"La implementaci\u00f3n Public Key Pinning (PKP) en Mozilla Firefox anterior a 33.0 salta las comprobaciones de fijaci\u00f3n (pinning) al encontrar un error no especificado de la verificaci\u00f3n de emisor, lo que facilita a atacantes remotos evadir la configuraci\u00f3n de fijaci\u00f3n (pinning) y suplantar un sitio web a trav\u00e9s de un certificado manipulado que conlleva a la presentaci\u00f3n del dialogo de conexi\u00f3n no confiable con el usuario.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-310\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"32.0\",\"matchCriteriaId\":\"97A0B769-5287-4E95-874B-F1D7FC41C7AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:30.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38EBC9E7-46AD-4DCD-AA7B-5071F55E3755\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11F024A-A8B7-405B-8A13-4BF406FBDB22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:firefox:31.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D81A3698-797C-4CD9-BB02-A9182E0A6E11\"}]}]}],\"references\":[{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://secunia.com/advisories/62022\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://secunia.com/advisories/62023\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://www.mozilla.org/security/announce/2014/mfsa2014-80.html\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://www.securityfocus.com/bid/70434\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://www.securitytracker.com/id/1031028\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2372-1\",\"source\":\"security@mozilla.org\"},{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=1066190\",\"source\":\"security@mozilla.org\"},{\"url\":\"https://security.gentoo.org/glsa/201504-01\",\"source\":\"security@mozilla.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/62022\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/62023\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.mozilla.org/security/announce/2014/mfsa2014-80.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/70434\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id/1031028\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-2372-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=1066190\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/201504-01\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T12:26:44+00:00",
      "cve": "CVE-2014-1584",
      "id": "CVE-2014-1584",
      "initial_release_date": "2014-10-14T00:00:00+00:00",
      "product_status:known_not_affected": "8",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Mozilla: Key pinning bypasses (MFSA 2014-80)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2014/cve-2014-1584.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T01:59:30Z",
      "cve": "CVE-2014-1584",
      "id": "CVE-2014-1584",
      "initial_release_date": "2023-02-15T05:30:42Z",
      "product_status:known_not_affected": "39",
      "product_status:recommended": "46",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2014-1584",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2014-1584.json",
      "version": "12"
    }
  }
}

CERTFR-2014-AVI-432

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été corrigées dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, un déni de service et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Mozilla	Thunderbird	Mozilla Thunderbird versions antérieures à 31.2
Mozilla	Firefox ESR	Mozilla Firefox ESR versions antérieures à 31.2
Mozilla	Firefox	Mozilla Firefox versions antérieures à 33

References

Title

Publication Time

CERTFR-2014-AVI-432

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Mozilla	Thunderbird	Mozilla Thunderbird versions antérieures à 31.2
Mozilla	Firefox ESR	Mozilla Firefox ESR versions antérieures à 31.2
Mozilla	Firefox	Mozilla Firefox versions antérieures à 33

References

Title

Publication Time

FKIE_CVE-2014-1584

Vulnerability from fkie_nvd - Published: 2014-10-15 10:55 - Updated: 2026-06-17 00:05

Severity

Summary

References

URL	Tags
security@mozilla.org	http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html
security@mozilla.org	http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html
security@mozilla.org	http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html
security@mozilla.org	http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html
security@mozilla.org	http://secunia.com/advisories/62022
security@mozilla.org	http://secunia.com/advisories/62023
security@mozilla.org	http://www.mozilla.org/security/announce/2014/mfsa2014-80.html	Vendor Advisory
security@mozilla.org	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
security@mozilla.org	http://www.securityfocus.com/bid/70434
security@mozilla.org	http://www.securitytracker.com/id/1031028
security@mozilla.org	http://www.ubuntu.com/usn/USN-2372-1
security@mozilla.org	https://bugzilla.mozilla.org/show_bug.cgi?id=1066190
security@mozilla.org	https://security.gentoo.org/glsa/201504-01
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/62022
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/62023
af854a3a-2127-422b-91ae-364da2661108	http://www.mozilla.org/security/announce/2014/mfsa2014-80.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/70434
af854a3a-2127-422b-91ae-364da2661108	http://www.securitytracker.com/id/1031028
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/USN-2372-1
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.mozilla.org/show_bug.cgi?id=1066190
af854a3a-2127-422b-91ae-364da2661108	https://security.gentoo.org/glsa/201504-01

Impacted products

Vendor	Product	Version
mozilla	firefox	*
mozilla	firefox	30.0
mozilla	firefox	31.0
mozilla	firefox	31.1.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "security@mozilla.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "97A0B769-5287-4E95-874B-F1D7FC41C7AF",
              "versionEndIncluding": "32.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:30.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "38EBC9E7-46AD-4DCD-AA7B-5071F55E3755",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C11F024A-A8B7-405B-8A13-4BF406FBDB22",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:31.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D81A3698-797C-4CD9-BB02-A9182E0A6E11",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user."
    },
    {
      "lang": "es",
      "value": "La implementaci\u00f3n Public Key Pinning (PKP) en Mozilla Firefox anterior a 33.0 salta las comprobaciones de fijaci\u00f3n (pinning) al encontrar un error no especificado de la verificaci\u00f3n de emisor, lo que facilita a atacantes remotos evadir la configuraci\u00f3n de fijaci\u00f3n (pinning) y suplantar un sitio web a trav\u00e9s de un certificado manipulado que conlleva a la presentaci\u00f3n del dialogo de conexi\u00f3n no confiable con el usuario."
    }
  ],
  "id": "CVE-2014-1584",
  "lastModified": "2026-06-17T00:05:13.553",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2014-10-15T10:55:06.990",
  "references": [
    {
      "source": "security@mozilla.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://secunia.com/advisories/62022"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://secunia.com/advisories/62023"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://www.securityfocus.com/bid/70434"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://www.securitytracker.com/id/1031028"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://www.ubuntu.com/usn/USN-2372-1"
    },
    {
      "source": "security@mozilla.org",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190"
    },
    {
      "source": "security@mozilla.org",
      "url": "https://security.gentoo.org/glsa/201504-01"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/62022"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/62023"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/70434"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1031028"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-2372-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/201504-01"
    }
  ],
  "sourceIdentifier": "security@mozilla.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-VHQR-98F2-RX6H

Vulnerability from github – Published: 2022-05-17 03:20 – Updated: 2022-05-17 03:20

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2014-1584"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-10-15T10:55:00Z",
    "severity": "MODERATE"
  },
  "details": "The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.",
  "id": "GHSA-vhqr-98f2-rx6h",
  "modified": "2022-05-17T03:20:59Z",
  "published": "2022-05-17T03:20:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1584"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201504-01"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/62022"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/62023"
    },
    {
      "type": "WEB",
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/70434"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1031028"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2372-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2014-1584

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2014-1584

Aliases

CVE-2014-1584

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2014-1584",
    "description": "The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.",
    "id": "GSD-2014-1584",
    "references": [
      "https://www.suse.com/security/cve/CVE-2014-1584.html",
      "https://ubuntu.com/security/CVE-2014-1584",
      "https://advisories.mageia.org/CVE-2014-1584.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2014-1584"
      ],
      "details": "The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.",
      "id": "GSD-2014-1584",
      "modified": "2023-12-13T01:22:51.533792Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@mozilla.org",
        "ID": "CVE-2014-1584",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "openSUSE-SU-2014:1344",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
          },
          {
            "name": "FEDORA-2014-13042",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
          },
          {
            "name": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html",
            "refsource": "CONFIRM",
            "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html"
          },
          {
            "name": "1031028",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1031028"
          },
          {
            "name": "openSUSE-SU-2014:1345",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
          },
          {
            "name": "70434",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/70434"
          },
          {
            "name": "GLSA-201504-01",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/201504-01"
          },
          {
            "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
            "refsource": "CONFIRM",
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
          },
          {
            "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190"
          },
          {
            "name": "FEDORA-2014-14084",
            "refsource": "FEDORA",
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
          },
          {
            "name": "USN-2372-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-2372-1"
          },
          {
            "name": "62022",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/62022"
          },
          {
            "name": "62023",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/62023"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:30.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:31.1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "32.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2014-1584"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-310"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-80.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1066190"
            },
            {
              "name": "USN-2372-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-2372-1"
            },
            {
              "name": "openSUSE-SU-2014:1345",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
            },
            {
              "name": "openSUSE-SU-2014:1344",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
            },
            {
              "name": "70434",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/70434"
            },
            {
              "name": "FEDORA-2014-14084",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
            },
            {
              "name": "FEDORA-2014-13042",
              "refsource": "FEDORA",
              "tags": [],
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
            },
            {
              "name": "62023",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/62023"
            },
            {
              "name": "62022",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/62022"
            },
            {
              "name": "1031028",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://www.securitytracker.com/id/1031028"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
            },
            {
              "name": "GLSA-201504-01",
              "refsource": "GENTOO",
              "tags": [],
              "url": "https://security.gentoo.org/glsa/201504-01"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2016-12-22T02:59Z",
      "publishedDate": "2014-10-15T10:55Z"
    }
  }
}

OPENSUSE-SU-2024:10071-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

MozillaFirefox-50.1.0-1.1 on GA media

Severity

Moderate

Scope

899 vulnerabilities in this advisory, including CVE-2014-1584.

CVE-2014-1584

Recommended: 24 products

Open the full advisory

OPENSUSE-SU-2024:10218-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

seamonkey-2.40-6.1 on GA media

Severity

Moderate

Scope

577 vulnerabilities in this advisory, including CVE-2014-1584.

CVE-2014-1584

Recommended: 20 products

Open the full advisory

ubuntu-cve-2014-1584

Vulnerability from osv_ubuntu

Published

2014-10-14 00:00

Modified

2026-04-22 07:37

Summary

Details

Severity

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2014-1584	REPORT
	https://www.mozilla.org/security/announce/2014/mf…	REPORT
	https://ubuntu.com/security/notices/USN-2372-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2014-1584	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "firefox",
            "binary_version": "33.0+build2-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "firefox-globalmenu",
            "binary_version": "33.0+build2-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "firefox-mozsymbols",
            "binary_version": "33.0+build2-0ubuntu0.14.04.1"
          },
          {
            "binary_name": "firefox-testsuite",
            "binary_version": "33.0+build2-0ubuntu0.14.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "firefox",
        "purl": "pkg:deb/ubuntu/firefox@33.0+build2-0ubuntu0.14.04.1?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "33.0+build2-0ubuntu0.14.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "24.0+build1-0ubuntu1",
        "25.0+build3-0ubuntu0.13.10.1",
        "28.0~b2+build1-0ubuntu2",
        "28.0+build1-0ubuntu1",
        "28.0+build2-0ubuntu1",
        "28.0+build2-0ubuntu2",
        "29.0+build1-0ubuntu0.14.04.2",
        "30.0+build1-0ubuntu0.14.04.3",
        "31.0+build1-0ubuntu0.14.04.1",
        "32.0+build1-0ubuntu0.14.04.1",
        "32.0.3+build1-0ubuntu0.14.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 skips pinning checks upon an unspecified issuer-verification error, which makes it easier for remote attackers to bypass an intended pinning configuration and spoof a web site via a crafted certificate that leads to presentation of the Untrusted Connection dialog to the user.",
  "id": "UBUNTU-CVE-2014-1584",
  "modified": "2026-04-22T07:37:41Z",
  "published": "2014-10-14T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-1584"
    },
    {
      "type": "REPORT",
      "url": "https://www.mozilla.org/security/announce/2014/mfsa2014-80.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2372-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-1584"
    }
  ],
  "related": [
    "USN-2372-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2014-1584"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2014-1584 (GCVE-0-2014-1584)

Solution

Solution

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature