CVE-2014-1568: High severity IBM Cognos Analytics vulnerability

Published Sep 25, 2014
·
Updated

Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.

Other sources

Mozilla Network Security Services (NSS) could allow a remote attacker to bypass security restrictions, caused by the failure to properly parse ASN.1 values in a digital signature. An attacker could exploit this vulnerability using a Bleichenbacher attack variant against the RSA algorithm to forge RSA certificates and gain unauthorized access to secure data.

Note: This vulnerability also affects Google Chrome.

— IBM

Affected Software

247 affected componentsFixes available
IBM Cognos Analytics<=12.0.0-12.0.3
IBM Cognos Analytics<=11.2.0-11.2.4 FP4
All of the following
Google Chrome<=37.0.2062.120
Any of the following
Apple iOS and macOS
Microsoft Windows
Mozilla Firefox<=32.0
Mozilla Firefox=31.0
Mozilla Firefox=31.1.0
Mozilla Firefox=32.0.1
Mozilla Firefox=32.0.2
Mozilla Firefox ESR=24.8.0
Mozilla Network Security Services<=3.16.2.0
Mozilla Network Security Services=3.2
Mozilla Network Security Services=3.2.1
Mozilla Network Security Services=3.3
Mozilla Network Security Services=3.3.1
Mozilla Network Security Services=3.3.2
Mozilla Network Security Services=3.4
Mozilla Network Security Services=3.4.1
Mozilla Network Security Services=3.4.2
Mozilla Network Security Services=3.5
Mozilla Network Security Services=3.6
Mozilla Network Security Services=3.6.1
Mozilla Network Security Services=3.7
Mozilla Network Security Services=3.7.1
Mozilla Network Security Services=3.7.2
Mozilla Network Security Services=3.7.3
Mozilla Network Security Services=3.7.5
Mozilla Network Security Services=3.7.7
Mozilla Network Security Services=3.8
Mozilla Network Security Services=3.9
Mozilla Network Security Services=3.11.2
Mozilla Network Security Services=3.11.3
Mozilla Network Security Services=3.11.4
Mozilla Network Security Services=3.11.5
Mozilla Network Security Services=3.12
Mozilla Network Security Services=3.12.1
Mozilla Network Security Services=3.12.2
Mozilla Network Security Services=3.12.3
Mozilla Network Security Services=3.12.3.1
Mozilla Network Security Services=3.12.3.2
Mozilla Network Security Services=3.12.4
Mozilla Network Security Services=3.12.5
Mozilla Network Security Services=3.12.6
Mozilla Network Security Services=3.12.7
Mozilla Network Security Services=3.12.8
Mozilla Network Security Services=3.12.9
Mozilla Network Security Services=3.12.10
Mozilla Network Security Services=3.12.11
Mozilla Network Security Services=3.14
Mozilla Network Security Services=3.14.1
Mozilla Network Security Services=3.14.2
Mozilla Network Security Services=3.14.3
Mozilla Network Security Services=3.14.4
Mozilla Network Security Services=3.14.5
Mozilla Network Security Services=3.15
Mozilla Network Security Services=3.15.1
Mozilla Network Security Services=3.15.2
Mozilla Network Security Services=3.15.3
Mozilla Network Security Services=3.15.3.1
Mozilla Network Security Services=3.15.4
Mozilla Network Security Services=3.15.5
Mozilla Network Security Services=3.16
Mozilla Network Security Services=3.16.1
Mozilla Network Security Services=3.16.3
Mozilla Network Security Services=3.16.4
Mozilla SeaMonkey
Mozilla SeaMonkey<=2.29
Mozilla SeaMonkey=1.0
Mozilla SeaMonkey=1.0-alpha
Mozilla SeaMonkey=1.0-beta
Mozilla SeaMonkey=1.0.1
Mozilla SeaMonkey=1.0.2
Mozilla SeaMonkey=1.0.3
Mozilla SeaMonkey=1.0.4
Mozilla SeaMonkey=1.0.5
Mozilla SeaMonkey=1.0.6
Mozilla SeaMonkey=1.0.7
Mozilla SeaMonkey=1.0.8
Mozilla SeaMonkey=1.0.9
Mozilla SeaMonkey=1.1
Mozilla SeaMonkey=1.1-alpha
Mozilla SeaMonkey=1.1-beta
Mozilla SeaMonkey=1.1.1
Mozilla SeaMonkey=1.1.2
Mozilla SeaMonkey=1.1.3
Mozilla SeaMonkey=1.1.4
Mozilla SeaMonkey=1.1.5
Mozilla SeaMonkey=1.1.6
Mozilla SeaMonkey=1.1.7
Mozilla SeaMonkey=1.1.8
Mozilla SeaMonkey=1.1.9
Mozilla SeaMonkey=1.1.10
Mozilla SeaMonkey=1.1.11
Mozilla SeaMonkey=1.1.12
Mozilla SeaMonkey=1.1.13
Mozilla SeaMonkey=1.1.14
Mozilla SeaMonkey=1.1.15
Mozilla SeaMonkey=1.1.16
Mozilla SeaMonkey=1.1.17
Mozilla SeaMonkey=1.1.18
Mozilla SeaMonkey=1.1.19
Mozilla SeaMonkey=1.5.0.8
Mozilla SeaMonkey=1.5.0.9
Mozilla SeaMonkey=1.5.0.10
Mozilla SeaMonkey=2.0
Mozilla SeaMonkey=2.0-alpha_1
Mozilla SeaMonkey=2.0-alpha_2
Mozilla SeaMonkey=2.0-alpha_3
Mozilla SeaMonkey=2.0-beta_1
Mozilla SeaMonkey=2.0-beta_2
Mozilla SeaMonkey=2.0-rc1
Mozilla SeaMonkey=2.0-rc2
Mozilla SeaMonkey=2.0.1
Mozilla SeaMonkey=2.0.2
Mozilla SeaMonkey=2.0.3
Mozilla SeaMonkey=2.0.4
Mozilla SeaMonkey=2.0.5
Mozilla SeaMonkey=2.0.6
Mozilla SeaMonkey=2.0.7
Mozilla SeaMonkey=2.0.8
Mozilla SeaMonkey=2.0.9
Mozilla SeaMonkey=2.0.10
Mozilla SeaMonkey=2.0.11
Mozilla SeaMonkey=2.0.12
Mozilla SeaMonkey=2.0.13
Mozilla SeaMonkey=2.0.14
Mozilla SeaMonkey=2.1
Mozilla SeaMonkey=2.1-alpha1
Mozilla SeaMonkey=2.1-alpha2
Mozilla SeaMonkey=2.1-alpha3
Mozilla SeaMonkey=2.1-beta1
Mozilla SeaMonkey=2.1-beta2
Mozilla SeaMonkey=2.1-beta3
Mozilla SeaMonkey=2.1-rc1
Mozilla SeaMonkey=2.1-rc2
Mozilla SeaMonkey=2.2
Mozilla SeaMonkey=2.2-beta1
Mozilla SeaMonkey=2.2-beta2
Mozilla SeaMonkey=2.2-beta3
Mozilla SeaMonkey=2.10
Mozilla SeaMonkey=2.10-beta1
Mozilla SeaMonkey=2.10-beta2
Mozilla SeaMonkey=2.10-beta3
Mozilla SeaMonkey=2.10.1
Mozilla SeaMonkey=2.11
Mozilla SeaMonkey=2.11-beta1
Mozilla SeaMonkey=2.11-beta2
Mozilla SeaMonkey=2.11-beta3
Mozilla SeaMonkey=2.11-beta4
Mozilla SeaMonkey=2.11-beta5
Mozilla SeaMonkey=2.11-beta6
Mozilla SeaMonkey=2.12
Mozilla SeaMonkey=2.12-beta1
Mozilla SeaMonkey=2.12-beta2
Mozilla SeaMonkey=2.12-beta3
Mozilla SeaMonkey=2.12-beta4
Mozilla SeaMonkey=2.12-beta5
Mozilla SeaMonkey=2.12-beta6
Mozilla SeaMonkey=2.12.1
Mozilla SeaMonkey=2.13
Mozilla SeaMonkey=2.13-beta1
Mozilla SeaMonkey=2.13-beta2
Mozilla SeaMonkey=2.13-beta3
Mozilla SeaMonkey=2.13-beta4
Mozilla SeaMonkey=2.13-beta5
Mozilla SeaMonkey=2.13-beta6
Mozilla SeaMonkey=2.13.1
Mozilla SeaMonkey=2.13.2
Mozilla SeaMonkey=2.14
Mozilla SeaMonkey=2.14-beta1
Mozilla SeaMonkey=2.14-beta2
Mozilla SeaMonkey=2.14-beta3
Mozilla SeaMonkey=2.14-beta4
Mozilla SeaMonkey=2.14-beta5
Mozilla SeaMonkey=2.15
Mozilla SeaMonkey=2.15-beta1
Mozilla SeaMonkey=2.15-beta2
Mozilla SeaMonkey=2.15-beta3
Mozilla SeaMonkey=2.15-beta4
Mozilla SeaMonkey=2.15-beta5
Mozilla SeaMonkey=2.15-beta6
Mozilla SeaMonkey=2.15.1
Mozilla SeaMonkey=2.15.2
Mozilla SeaMonkey=2.16
Mozilla SeaMonkey=2.16-beta1
Mozilla SeaMonkey=2.16-beta2
Mozilla SeaMonkey=2.16-beta3
Mozilla SeaMonkey=2.16-beta4
Mozilla SeaMonkey=2.16-beta5
Mozilla SeaMonkey=2.16.1
Mozilla SeaMonkey=2.16.2
Mozilla SeaMonkey=2.17
Mozilla SeaMonkey=2.17-beta1
Mozilla SeaMonkey=2.17-beta2
Mozilla SeaMonkey=2.17-beta3
Mozilla SeaMonkey=2.17-beta4
Mozilla SeaMonkey=2.17.1
Mozilla SeaMonkey=2.18-beta1
Mozilla SeaMonkey=2.18-beta2
Mozilla SeaMonkey=2.18-beta3
Mozilla SeaMonkey=2.18-beta4
Mozilla SeaMonkey=2.19
Mozilla SeaMonkey=2.19-beta1
Mozilla SeaMonkey=2.19-beta2
Mozilla SeaMonkey=2.20
Mozilla SeaMonkey=2.20-beta1
Mozilla SeaMonkey=2.20-beta2
Mozilla SeaMonkey=2.20-beta3
Mozilla SeaMonkey=2.21-beta1
Mozilla SeaMonkey=2.21-beta2
Mozilla SeaMonkey=2.22-beta1
Mozilla SeaMonkey=2.22-beta2
Mozilla SeaMonkey=2.22.1
Mozilla SeaMonkey=2.23
Mozilla SeaMonkey=2.23-beta1
Mozilla SeaMonkey=2.24
Mozilla SeaMonkey=2.24-beta1
Mozilla SeaMonkey=2.25
Mozilla SeaMonkey=2.25-beta1
Mozilla SeaMonkey=2.25-beta2
Mozilla SeaMonkey=2.25-beta3
Mozilla SeaMonkey=2.26
Mozilla SeaMonkey=2.26-rc1
Mozilla Thunderbird<=24.8.0
Mozilla Thunderbird=31.0
Mozilla Thunderbird=31.1.0
Mozilla Thunderbird=31.1.1
All of the following
Any of the following
Google Chrome<=37.0.2062.103
Google Chrome=37.0.2062.0
Google Chrome=37.0.2062.3
Google Chrome=37.0.2062.20
Google Chrome=37.0.2062.100
Google Chrome=37.0.2062.102
Google Chrome OS
Google Chrome<=37.0.2062.120
Apple iOS and macOS
Microsoft Windows
Mozilla Firefox ESR=31.0
Mozilla Firefox ESR=31.1.0
Google Chrome<=37.0.2062.103
Google Chrome=37.0.2062.0
Google Chrome=37.0.2062.3
Google Chrome=37.0.2062.20
Google Chrome=37.0.2062.100
Google Chrome=37.0.2062.102
Google Chrome OS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Mozilla NSS to a version that resolves this vulnerability.

    Fixed in 3.16.2.1
  2. Upgrade

    Upgrade Mozilla NSS 3.16.x to a version that resolves this vulnerability.

    Fixed in 3.16.5
  3. Upgrade

    Upgrade Mozilla NSS 3.17.x to a version that resolves this vulnerability.

    Fixed in 3.17.1
  4. Upgrade

    Upgrade Mozilla Firefox to a version that resolves this vulnerability.

    Fixed in 32.0.3
  5. Upgrade

    Upgrade Mozilla Firefox ESR 24.x to a version that resolves this vulnerability.

    Fixed in 24.8.1
  6. Upgrade

    Upgrade Mozilla Firefox ESR 31.x to a version that resolves this vulnerability.

    Fixed in 31.1.1
  7. Upgrade

    Upgrade Mozilla Thunderbird 24.x to a version that resolves this vulnerability.

    Fixed in 24.8.1
  8. Upgrade

    Upgrade Mozilla Thunderbird 31.x to a version that resolves this vulnerability.

    Fixed in 31.1.2
  9. Upgrade

    Upgrade Mozilla SeaMonkey to a version that resolves this vulnerability.

    Fixed in 2.29.1
  10. Upgrade

    Upgrade Google Chrome on Windows and OS X to a version that resolves this vulnerability.

    Fixed in 37.0.2062.124
  11. Upgrade

    Upgrade Google Chrome OS to a version that resolves this vulnerability.

    Fixed in 37.0.2062.120

Event History

Sep 25, 2014
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What versions are affected by CVE-2014-1568?

CVE-2014-1568 affects various versions of Mozilla NSS, Firefox, Thunderbird, and SeaMonkey prior to specified versions including Firefox 32.0.3.

2

What is the impact of CVE-2014-1568?

CVE-2014-1568 can lead to potential security vulnerabilities in applications dependent on Mozilla's Network Security Services.

3

How can I mitigate CVE-2014-1568?

To mitigate CVE-2014-1568, upgrade affected software to their latest versions as specified by the vendors.

4

Does CVE-2014-1568 affect Google Chrome?

Yes, CVE-2014-1568 affects Google Chrome versions up to 37.0.2062.120.

5

Is CVE-2014-1568 a critical vulnerability?

CVE-2014-1568 is considered a significant security risk due to its exploitation potential in various applications.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203