Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade nss-utilUpgrade nss-pkcs11-develUpgrade nss-develUpgrade nss-toolsUpgrade nsprUpgrade nss-util-develUpgrade nss-sysinitUpgrade nspr-develUpgrade nss | Dec 1, 2016 | Feb 6, 2014 |
| Debian | — | Upgrade iceweaselUpgrade nss | Jul 30, 2024 | Feb 6, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 17, 2015 |
| Freebsd | — | Upgrade linux-thunderbirdUpgrade linux-seamonkeyUpgrade firefoxUpgrade thunderbirdUpgrade linux-firefoxUpgrade seamonkey | Dec 10, 2025 | Feb 4, 2014 |
| Gentoo Linux | — | Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade www-client/seamonkey.Upgrade www-client/seamonkey-bin.Upgrade dev-libs/nspr.Upgrade www-client/firefox.Upgrade mail-client/thunderbird. | Oct 30, 2017 | Feb 6, 2014 |
| Mfsa2014 12 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox version 27.0Upgrade to Mozilla Firefox ESR version 24.3 | Feb 5, 2014 | Feb 4, 2014 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.24.0 | Dec 8, 2014 | Feb 6, 2014 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 24.3 | Feb 5, 2014 | Feb 4, 2014 |
| Oracle Solaris | — | Upgrade consolidation/desktop/desktop-incorporation to version 0.5.11-0.175.3.0.0.28.0 on Solaris 11.3Upgrade runtime/tcl-8/tcl-sqlite-3 to version 3.8.2-0.175.2.5.0.4.0 on Solaris 11.2Upgrade web/browser/firefox to version 24.7.0-0.175.2.5.0.4.0 on Solaris 11.2Upgrade database/sqlite-3/documentation to version 3.8.2-0.175.2.5.0.4.0 on Solaris 11.2Upgrade database/sqlite-3 to version 3.8.2-0.175.2.5.0.4.0 on Solaris 11.2 | May 29, 2017 | Feb 6, 2014 |
| Oracle_linux | — | Upgrade nsprUpgrade nss-develUpgrade nss-pkcs11-develUpgrade nss-util-develUpgrade nss-utilUpgrade nspr-develUpgrade nss-toolsUpgrade nssUpgrade nss-sysinit | Oct 16, 2024 | Feb 6, 2014 |
| Suse | — | Upgrade MozillaFirefox-branding-SLEDUpgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbird-develUpgrade mozilla-nss-32bitUpgrade firefox-libgcc_s1Upgrade libfreebl3Upgrade libfreebl3-x86Upgrade MozillaFirefox-develUpgrade mozilla-nss-certsUpgrade MozillaThunderbird-translations-commonUpgrade libsoftokn3-hmacUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-develUpgrade mozilla-nssUpgrade mozilla-nss-certs-32bitUpgrade MozillaFirefox-translations-commonUpgrade libsoftokn3Upgrade mozilla-nss-toolsUpgrade libfreebl3-hmacUpgrade mozilla-nss-x86Upgrade firefox-libstdc++6Upgrade MozillaFirefoxUpgrade mozilla-nspr-32bitUpgrade libsoftokn3-x86Upgrade libsoftokn3-32bitUpgrade libfreebl3-32bitUpgrade MozillaFirefox-translationsUpgrade mozilla-nsprUpgrade mozilla-nss-sysinitUpgrade MozillaThunderbird | Dec 18, 2015 | Feb 6, 2014 |
| Ubuntu | — | Upgrade firefoxUpgrade thunderbird | Nov 8, 2024 | Feb 6, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub