CVE-2014-1569

The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.

• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html
• http://www.debian.org/security/2015/dsa-3186
• http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdfExploit
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
• http://www.securitytracker.com/id/1032909
• https://bugzilla.mozilla.org/show_bug.cgi?id=1064670Exploit
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notesVendor Advisory
• https://www.imperialviolet.org/2014/09/26/pkcs1.htmlExploit
• https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02Exploit
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00000.html
• http://www.debian.org/security/2015/dsa-3186
• http://www.intelsecurity.com/resources/wp-berserk-analysis-part-1.pdfExploit
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
• http://www.securitytracker.com/id/1032909
• https://bugzilla.mozilla.org/show_bug.cgi?id=1064670Exploit
• https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.3_release_notesVendor Advisory
• https://www.imperialviolet.org/2014/09/26/pkcs1.htmlExploit
• https://www.reddit.com/r/netsec/comments/2hd1m8/rsa_signature_forgery_in_nss/cksnr02Exploit

Published

Dec 15, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-1563Use-after-free vulnerability in the mozilla::DOMSVGLength::G…
• CVE-2014-1564Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, a…
• CVE-2014-1565The mozilla::dom::AudioEventTimeline function in the Web Aud…
• CVE-2014-1566Mozilla Firefox before 31.1 on Android does not properly res…
• CVE-2014-1567Use-after-free vulnerability in DirectionalityUtils.cpp in M…
• CVE-2014-1568Mozilla Network Security Services (NSS) before 3.16.2.1, 3.1…
• CVE-2014-1571Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x be…
• CVE-2014-1572The confirm_create_account function in the account-creation …
• CVE-2014-1573Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x be…
• CVE-2014-1574Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2014-1575Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2014-1576Heap-based buffer overflow in the nsTransformedTextRun funct…