Bug 1121480 (CVE-2014-1558, CVE-2014-1559, CVE-2014-1560) - CVE-2014-1558 CVE-2014-1559 CVE-2014-1560 Mozilla: Certificate parsing broken by non-standard character encoding (MFSA 2014-65)
Summary: CVE-2014-1558 CVE-2014-1559 CVE-2014-1560 Mozilla: Certificate parsing broken...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2014-1558, CVE-2014-1559, CVE-2014-1560
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20140722,repor...
Depends On:
Blocks: 1118216
TreeView+ depends on / blocked
 
Reported: 2014-07-21 05:09 UTC by Huzaifa S. Sidhpurwala
Modified: 2019-06-08 20:07 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-07-21 05:13:43 UTC


Attachments (Terms of Use)

Description Huzaifa S. Sidhpurwala 2014-07-21 05:09:23 UTC
Mozilla security researcher Christian Holler discovered several issues while fuzzing the parsing of SSL certificates. Two of these issues were a result of using characters that are not UTF-8 in certificates when various functions expected all strings to be UTF-8 format. The third issue was a result of using characters that were not ASCII in certificates while a function expected only ASCII formatted text. All of these issues causes the certificates to be incorrectly parsed, leading to a potential inability to use valid SSL certificates.



External Reference:

http://www.mozilla.org/security/announce/2014/mfsa2014-65.html


Acknowledgements:

Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Christian Holler as the original reporter.

Statement:

This issue does not affect the version of thunderbird as shipped with Red Hat Enterprise Linux 5 and 6, or the version of firefox as shipped with Red Hat Enterprise Linux 5, 6, and 7.


Note You need to log in before you can comment on or make changes to this bug.