CVE-2014-1569 json
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.…
published 2014-12-15 11 y ago modified 2026-06-17 4 mo ago also EUVD-2014-1645
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.2%
- EPSS 3.2% chance of exploitation in 30 days, percentile 88%
- public exploits
- 0
- none known
Summary
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.
Patch / fix
- nss Debian 14, Debian 13, Debian 12 2:3.17.2-1.1
debian advisories DEBIAN-CVE-2014-1569
- nss Ubuntu 14.04 LTS 2:3.17.1-0ubuntu0.14.04.2
ubuntu advisories UBUNTU-CVE-2014-1569
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- nspr RHEL 7 4.10.8-1.el7_1
- nspr RHEL 7 4.10.8-1.ael7b_1
- nss RHEL 7 3.18.0-2.2.el7_1
- nss RHEL 7 3.18.0-2.2.ael7b_1
- nss-util RHEL 7 3.18.0-1.el7_1
- nss-util RHEL 7 3.18.0-1.ael7b_1
- nss-tools RHEL 7 3.18.0-2.2.el7_1
- nss-tools RHEL 7 3.18.0-2.2.ael7b_1
red hat advisories RHBA-2015:0965RHBA-2015:0926RHBA-2015:0925
- mozilla-nss openSUSE Tumbleweed 3.26.2-1.1
opensuse advisories openSUSE-SU-2024:10451-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2014-1569 updated cvss 5.8
nss: QuickDER decoder length issue
-
Red Hat Enterprise Linux (v. 5 server) nss 3.18.0-6.el5_11, nspr 4.10.8-1.el5_11, nss-tools 3.18.0-6.el5_11fixed: vendor fix RHBA-2015:0925
-
Red Hat Enterprise Linux Client (v. 7) nspr 4.10.8-1.el7_1, nss 3.18.0-2.2.el7_1, nss-util 3.18.0-1.el7_1, nss-tools 3.18.0-2.2.el7_1, nss-sysinit 3.18.0-2.2.el7_1 Red Hat Enterprise Linux Client Optional (v. 7) nspr-devel 4.10.8-1.el7_1, nss-devel 3.18.0-2.2.el7_1, nspr-debuginfo 4.10.8-1.el7_1, nss-util-devel 3.18.0-1.el7_1, nss-debuginfo 3.18.0-2.2.el7_1, nss-pkcs11-devel 3.18.0-2.2.el7_1, +1 more Red Hat Enterprise Linux ComputeNode (v. 7) nspr 4.10.8-1.el7_1, nss 3.18.0-2.2.el7_1, nss-util 3.18.0-1.el7_1, nss-tools 3.18.0-2.2.el7_1, nss-sysinit 3.18.0-2.2.el7_1 Red Hat Enterprise Linux ComputeNode Optional (v. 7) nspr-devel 4.10.8-1.el7_1, nss-devel 3.18.0-2.2.el7_1, nspr-debuginfo 4.10.8-1.el7_1, nss-util-devel 3.18.0-1.el7_1, nss-debuginfo 3.18.0-2.2.el7_1, nss-pkcs11-devel 3.18.0-2.2.el7_1, +1 morefixed: vendor fix RHBA-2015:0965
-
Red Hat Enterprise Linux Desktop (v. 5 client) nss 3.18.0-6.el5_11, nspr 4.10.8-1.el5_11, nss-tools 3.18.0-6.el5_11fixed: vendor fix RHBA-2015:0925
-
Red Hat Enterprise Linux Desktop (v. 6) nspr 4.10.8-1.el6_6, nss 3.18.0-5.3.el6_6, nss-util 3.18.0-1.el6_6, nss-tools 3.18.0-5.3.el6_6, nss-sysinit 3.18.0-5.3.el6_6 Red Hat Enterprise Linux Desktop Optional (v. 6) nspr-devel 4.10.8-1.el6_6, nss-devel 3.18.0-5.3.el6_6, nspr-debuginfo 4.10.8-1.el6_6, nss-util-devel 3.18.0-1.el6_6, nss-debuginfo 3.18.0-5.3.el6_6, nss-pkcs11-devel 3.18.0-5.3.el6_6, +1 morefixed: vendor fix RHBA-2015:0926
-
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) nss 3.18.0-6.el5_11, nspr 4.10.8-1.el5_11fixed: vendor fix RHBA-2015:0925
-
Red Hat Enterprise Linux HPC Node (v. 6) nspr 4.10.8-1.el6_6, nss 3.18.0-5.3.el6_6, nss-util 3.18.0-1.el6_6, nss-tools 3.18.0-5.3.el6_6, nss-sysinit 3.18.0-5.3.el6_6 Red Hat Enterprise Linux HPC Node Optional (v. 6) nspr-devel 4.10.8-1.el6_6, nss-devel 3.18.0-5.3.el6_6, nspr-debuginfo 4.10.8-1.el6_6, nss-util-devel 3.18.0-1.el6_6, nss-debuginfo 3.18.0-5.3.el6_6, nss-pkcs11-devel 3.18.0-5.3.el6_6, +1 more Red Hat Enterprise Linux Server (v. 6) nspr 4.10.8-1.el6_6, nss 3.18.0-5.3.el6_6, nss-util 3.18.0-1.el6_6, nss-tools 3.18.0-5.3.el6_6, nss-sysinit 3.18.0-5.3.el6_6fixed: vendor fix RHBA-2015:0926
-
Red Hat Enterprise Linux Server (v. 7) nspr 4.10.8-1.el7_1, nss 3.18.0-2.2.el7_1, nspr 4.10.8-1.ael7b_1, nss 3.18.0-2.2.ael7b_1, nss-util 3.18.0-1.el7_1, nss-util 3.18.0-1.ael7b_1, +4 morefixed: vendor fix RHBA-2015:0965
-
Red Hat Enterprise Linux Server Optional (v. 6) nss-debuginfo 3.18.0-5.3.el6_6, nss-pkcs11-devel 3.18.0-5.3.el6_6fixed: vendor fix RHBA-2015:0926
show 5 moreshow fewer
-
Red Hat Enterprise Linux Server Optional (v. 7) nss-debuginfo 3.18.0-2.2.el7_1, nss-debuginfo 3.18.0-2.2.ael7b_1, nss-pkcs11-devel 3.18.0-2.2.el7_1, nss-pkcs11-devel 3.18.0-2.2.ael7b_1fixed: vendor fix RHBA-2015:0965
-
Red Hat Enterprise Linux Workstation (v. 6) nspr 4.10.8-1.el6_6, nss 3.18.0-5.3.el6_6, nss-util 3.18.0-1.el6_6, nss-tools 3.18.0-5.3.el6_6, nss-sysinit 3.18.0-5.3.el6_6fixed: vendor fix RHBA-2015:0926
-
Red Hat Enterprise Linux Workstation (v. 7) nspr 4.10.8-1.el7_1, nss 3.18.0-2.2.el7_1, nss-util 3.18.0-1.el7_1, nss-tools 3.18.0-2.2.el7_1, nss-sysinit 3.18.0-2.2.el7_1fixed: vendor fix RHBA-2015:0965
-
Red Hat Enterprise Linux Workstation Optional (v. 6) nss-debuginfo 3.18.0-5.3.el6_6, nss-pkcs11-devel 3.18.0-5.3.el6_6fixed: vendor fix RHBA-2015:0926
-
Red Hat Enterprise Linux Workstation Optional (v. 7) nss-debuginfo 3.18.0-2.2.el7_1, nss-pkcs11-devel 3.18.0-2.2.el7_1fixed: vendor fix RHBA-2015:0965
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
3.18% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- bugzilla.mozilla.org https://bugzilla.mozilla.org/show_bug.cgi?id=1064670 referenced PoC, tagged "exploit" by a source, unverified
- intelsecurity.com http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdf referenced PoC, tagged "exploit" by a source, unverified
- imperialviolet.org https://www.imperialviolet.org/2014/09/26/pkcs1.html referenced PoC, tagged "exploit" by a source, unverified
- reddit.com https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
bugzilla.mozilla.org
/show_bug.cgi?id=1064670
exploit
-
intelsecurity.com
/resources/wp-berserk-analysis-part-1.pdf
exploit
-
imperialviolet.org
/2014/09/26/pkcs1.html
exploit
-
reddit.com
/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02
exploit
-
lists.opensuse.org
/opensuse-security-announce/2015-01/msg00024.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-01/msg00033.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-01/msg00032.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-03/msg00000.html
vendor-advisory
-
debian.org
/security/2015/dsa-3186
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2015-01/msg00036.html
vendor-advisory
-
developer.mozilla.org
/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notes
vendor-advisory
- oracle.com /technetwork/topics/security/cpujul2015-2367936.html
-
securitytracker.com
/id/1032909
vdb-entry
- oracle.com /technetwork/topics/security/cpuoct2015-2367953.html
- oracle.com /technetwork/topics/security/bulletinapr2016-2952098.html
Sources
- CVE List CVE-2014-1569
- NVD CVE-2014-1569
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.