CVE-2025-1014: Certificate length was not properly checked
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 135.0-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 128.7.0esr-1~deb11u1Fixed in 128.7.0esr-1~deb12u1Fixed in 128.7.0esr-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.7.0esr-1~deb11u1Fixed in 1:128.7.0esr-1~deb12u1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 128.7 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 135 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 128.7 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 135
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-1014?
CVE-2025-1014 is rated as a moderate severity vulnerability due to improper length checks of certificates.
How do I fix CVE-2025-1014?
To fix CVE-2025-1014, update to Firefox versions 135 or later and Thunderbird versions 128.7 or later.
Which products are affected by CVE-2025-1014?
CVE-2025-1014 affects Firefox versions below 135, Thunderbird versions below 128.7, and their respective ESR versions.
What kind of data is affected by CVE-2025-1014?
CVE-2025-1014 impacts certificates added to a certificate store due to inadequate length checks.
Is CVE-2025-1014 actively exploited?
As of the latest updates, CVE-2025-1014 has not been reported as actively exploited in the wild.