CVE

Id
68877  
CVE No.
CVE-2014-1582  
Status
Candidate  
Description
The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address, which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.  
Phase
Assigned (20140116)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
662726 68877 CVE-2014-1582 CONFIRM:http://www.mozilla.org/security/announce/2014/mfsa2014-80.html  View
662727 68877 CVE-2014-1582 CONFIRM:https://bugzilla.mozilla.org/show_bug.cgi?id=1049095  View
662728 68877 CVE-2014-1582 CONFIRM:http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
662729 68877 CVE-2014-1582 FEDORA:FEDORA-2014-13042  View
662730 68877 CVE-2014-1582 URL:http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html  View
662731 68877 CVE-2014-1582 FEDORA:FEDORA-2014-14084  View
662732 68877 CVE-2014-1582 URL:http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html  View
662733 68877 CVE-2014-1582 GENTOO:GLSA-201504-01  View
662734 68877 CVE-2014-1582 URL:https://security.gentoo.org/glsa/201504-01  View
662735 68877 CVE-2014-1582 SUSE:openSUSE-SU-2014:1344  View
662736 68877 CVE-2014-1582 URL:http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html  View
662737 68877 CVE-2014-1582 SUSE:openSUSE-SU-2014:1345  View
662738 68877 CVE-2014-1582 URL:http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html  View
662739 68877 CVE-2014-1582 UBUNTU:USN-2372-1  View
662740 68877 CVE-2014-1582 URL:http://www.ubuntu.com/usn/USN-2372-1  View
662741 68877 CVE-2014-1582 BID:70432  View
662742 68877 CVE-2014-1582 URL:http://www.securityfocus.com/bid/70432  View
662743 68877 CVE-2014-1582 SECTRACK:1031028  View
662744 68877 CVE-2014-1582 URL:http://www.securitytracker.com/id/1031028  View
662745 68877 CVE-2014-1582 SECUNIA:62022  View
662746 68877 CVE-2014-1582 URL:http://secunia.com/advisories/62022  View
662747 68877 CVE-2014-1582 SECUNIA:62023  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
17025 JVNDB-2014-005900 複数の Mozilla 製品の XMLHttpRequest.prototype.send メソッドにおけるサービス運用妨害 (DoS) の脆弱性 Mozilla Firefox、Thunderbird、および SeaMonkey の XMLHttpRequest.prototype.send メソッドには、サービス運用妨害 (アプリケーションクラッシュ) 状態にされる脆弱性が存在します。 CVE-2014-1590 68877 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005900.html  View