Mozilla Foundation Security Advisory 2014-63
Use-after-free while when manipulating certificates in the trusted cache
- Announced
- July 22, 2014
- Reporter
- Tyson Smith, Jesse Schwartzentruber
- Impact
- High
- Products
- Firefox, Firefox ESR, Thunderbird
- Fixed in
-
- Firefox 31
- Firefox ESR 24.7
- Thunderbird 24.7
- Thunderbird 31
Description
Security researchers Tyson Smith and Jesse
Schwartzentruber used the Address Sanitizer tool while fuzzing to
discover a use-after-free error resulting in a crash. This is a result of a pair
of NSSCertificate structures being added to a trust domain and then
one of them is removed while they are still in use by the trusted cache. This
crash is potentially exploitable.
This issue was addressed in the Network Security Services (NSS) library in version 3.16.2, shipping on affected platforms.
In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts.