QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2014-1492

Back to search

CVE-2014-1492

Published: Mar 25, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

VendorProductVersions

n/a

n/a

affected
n/a

References

DSA-2994
vendor-advisory
x_refsource_DEBIAN
openSUSE-SU-2014:0599
vendor-advisory
x_refsource_SUSE
openSUSE-SU-2014:0629
vendor-advisory
x_refsource_SUSE
SUSE-SU-2014:0727
vendor-advisory
x_refsource_SUSE
60621
third-party-advisory
x_refsource_SECUNIA
60794
third-party-advisory
x_refsource_SECUNIA
GLSA-201504-01
vendor-advisory
x_refsource_GENTOO
59866
third-party-advisory
x_refsource_SECUNIA
SUSE-SU-2014:0665
vendor-advisory
x_refsource_SUSE
USN-2185-1
vendor-advisory
x_refsource_UBUNTU
66356
vdb-entry
x_refsource_BID
USN-2159-1
vendor-advisory
x_refsource_UBUNTU
FEDORA-2014-5829
vendor-advisory
x_refsource_FEDORA

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now