CVE-2025-1014: Certificate length was not properly checked

Q: What is the severity of CVE-2025-1014?

CVE-2025-1014 is rated as a moderate severity vulnerability due to improper length checks of certificates.

Q: How do I fix CVE-2025-1014?

To fix CVE-2025-1014, update to Firefox versions 135 or later and Thunderbird versions 128.7 or later.

Q: Which products are affected by CVE-2025-1014?

CVE-2025-1014 affects Firefox versions below 135, Thunderbird versions below 128.7, and their respective ESR versions.

Q: What kind of data is affected by CVE-2025-1014?

CVE-2025-1014 impacts certificates added to a certificate store due to inadequate length checks.

Q: Is CVE-2025-1014 actively exploited?

As of the latest updates, CVE-2025-1014 has not been reported as actively exploited in the wild.

Published Feb 4, 2025

Updated

Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

Other sources

Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.

— Red Hat

Affected Software

22 affected componentsFixes available

Mozilla Firefox<135

135

Mozilla Firefox ESR<128.7

128.7

Mozilla Thunderbird<135

135

Mozilla Firefox<128.7.0

Mozilla Firefox<135.0

Mozilla Thunderbird>=128.0.1<128.7.0

Mozilla Thunderbird>=131.0<135.0

ubuntu/mozjs52*

ubuntu/mozjs38*

ubuntu/firefox<135.0+build2-0ubuntu0.20.04.1

135.0+build2-0ubuntu0.20.04.1

ubuntu/mozjs68*

ubuntu/mozjs52*

ubuntu/mozjs102*

ubuntu/mozjs78*

ubuntu/mozjs91*

ubuntu/thunderbird<1:128.12.0+build1-0ubuntu0.22.04.1

1:128.12.0+build1-0ubuntu0.22.04.1

ubuntu/mozjs102*

ubuntu/mozjs115*

Mozilla Thunderbird<128.7

128.7

debian/firefox

159.0-1

debian/firefox-esr

140.12.0esr-1~deb12u1153.6.0esr-1~deb12u2140.15.0esr-1~deb13u1153.6.0esr-1~deb13u1153.5.1esr-1153.6.0esr-1

debian/thunderbird

1:140.12.0esr-1~deb12u11:153.6.0esr-1~deb12u11:140.12.0esr-1~deb13u11:153.5.1esr-1~deb13u21:153.5.0esr-11:153.6.0esr-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Firefox to a version that resolves this vulnerability.
Fixed in 135
Upgrade
Upgrade Firefox ESR to a version that resolves this vulnerability.
Fixed in 128.7
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 135
Upgrade
Upgrade ubuntu/firefox to a version that resolves this vulnerability.
Fixed in 135.0+build2-0ubuntu0.20.04.1
Upgrade
Upgrade ubuntu/thunderbird to a version that resolves this vulnerability.
Fixed in 1:128.12.0+build1-0ubuntu0.22.04.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.7
Upgrade
Upgrade debian/firefox to a version that resolves this vulnerability.
Fixed in 159.0-1
Upgrade
Upgrade debian/firefox-esr to a version that resolves this vulnerability.
Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1
Upgrade
Upgrade debian/thunderbird to a version that resolves this vulnerability.
Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.5.1esr-1~deb13u2Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 128.7

Event History

Feb 4, 2025

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·01:58 PM

Data Sourced

via MITRE·01:58 PM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via Red Hat·03:02 PM

DescriptionSeverityAffected Software

Feb 6, 2025

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Data Sourced

via Ubuntu·12:00 AM

RemedyDescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2025-1014?

CVE-2025-1014 is rated as a moderate severity vulnerability due to improper length checks of certificates.

How do I fix CVE-2025-1014?

To fix CVE-2025-1014, update to Firefox versions 135 or later and Thunderbird versions 128.7 or later.

Which products are affected by CVE-2025-1014?

CVE-2025-1014 affects Firefox versions below 135, Thunderbird versions below 128.7, and their respective ESR versions.

What kind of data is affected by CVE-2025-1014?

CVE-2025-1014 impacts certificates added to a certificate store due to inadequate length checks.

Is CVE-2025-1014 actively exploited?

As of the latest updates, CVE-2025-1014 has not been reported as actively exploited in the wild.

CVE-2025-1014: Certificate length was not properly checked

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-1014?

How do I fix CVE-2025-1014?

Which products are affected by CVE-2025-1014?

What kind of data is affected by CVE-2025-1014?

Is CVE-2025-1014 actively exploited?

Company

Resources

Contact