Mozilla Network Security Services (NSS) fails to properly verify RSA signatures

https://www.mozilla.org/security/announce/2014/mfsa2014-73.html

Code:

RSA Signature Forgery in NSS
Impact: Critical
Announced: September 24, 2014
...
Fixed in:
  Firefox 32.0.3
  Firefox ESR 24.8.1
  Firefox ESR 31.1.1
  Thunderbird 31.1.2
  Thunderbird 24.8.1
  SeaMonkey 2.29.1
  NSS 3.16.2.1
  NSS 3.16.5
  NSS 3.17.1

 

Fixed in Firefox 32.0.3 | https://www.mozilla.org/security/announce/2014/mfsa2014-73.html

Fixed in Thunderbird 31.1.2 | https://www.mozilla.org/security/announce/2014/mfsa2014-73.html

Security Advisories for Firefox -
https://www.mozilla.org/security/known-vulnerabilities/firefox.html

Security Advisories for Thunderbird -
https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html

 

Fixed in Tails 1.1.2 | https://tails.boum.org/news/version_1.1.2/index.en.html

Fixed in Cyberfox 32.0.3 | https://8pecxstudios.com/hooray-your-cyberfox-is-up-to-date-32-0-3

Fixed in SeaMonkey 2.29.1 | https://www.mozilla.org/security/known-vulnerabilities/seamonkey.html

 

Fixed in Opera 24.0.1558.64 | http://blogs.opera.com/desktop/2014/09/security-update-opera-stable-24/

 

PKCS#1 signature validation

https://www.imperialviolet.org/2014/09/26/pkcs1.html


Pale Moon is still vulnerable, will be fixed in upcoming 25.0 release.

 

'BERserk' Bug Uncovered In Mozilla NSS Crypto Library Impacts Firefox, Chrome

Related: Mozilla Firefox Web Browser International Downloads.

Note: Latest release of Firefox is 32.0.3

-- Tom

 

Fixed in Pale Moon 25.0 | http://www.palemoon.org/releasenotes.shtml

 

Fixed in Pidgin 2.10.10 | https://developer.pidgin.im/wiki/ChangeLog