CVE-2014-1490: Use After Free
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1490?
CVE-2014-1490 is classified as a moderate severity vulnerability that can lead to a denial of service.
How do I fix CVE-2014-1490?
To mitigate CVE-2014-1490, upgrade to the latest versions of the affected software, such as Mozilla Firefox 27.0 or later.
What products are affected by CVE-2014-1490?
CVE-2014-1490 affects Mozilla Firefox, Firefox ESR, Thunderbird, SeaMonkey, and other products utilizing Mozilla NSS before specified versions.
What type of vulnerability is CVE-2014-1490?
CVE-2014-1490 involves a race condition leading to a use-after-free vulnerability.
Can CVE-2014-1490 be exploited remotely?
Yes, CVE-2014-1490 can be exploited remotely by attackers to cause a denial of service.