CVE-2014-8642

Published: 14 January 2015

Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the id-pkix-ocsp-nocheck extension in deciding whether to trust an OCSP responder, which makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which there was an incorrect decision to accept a compromised and revoked certificate.

Priority

Status

Package	Release	Status
firefox Launchpad, Ubuntu, Debian	lucid	Ignored (reached end of life)
	precise	Released (35.0+build3-0ubuntu0.12.04.2)
	trusty	Does not exist (trusty was released [35.0+build3-0ubuntu0.14.04.2])
	upstream	Released (35.0)
	utopic	Released (35.0+build3-0ubuntu0.14.10.2)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8642
https://www.mozilla.org/en-GB/security/advisories/mfsa2015-08/
https://ubuntu.com/security/notices/USN-2458-1
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›