CVE-2014-1582

La implementación Public Key Pinning (PKP) en Mozilla Firefox anterior a 33.0 no considera debidamente el comportamiento de la integración de conexiones (connection-coalescing) de SPDY y HTTP/2 en el caso de una dirección IP compartida, lo que permite a atacantes man-in-the-middle evadir una configuración de fijación (pinning) y suplantar un sitio web mediante la provisión de un certificado válido de una autoridad de certificación reconocida y arbitraria.

Bobby Holley, Christian Holler, David Bolter, Byron Campen, Jon Coppeard, Carsten Book, Martijn Wargers, Shih-Chiang Chien, Terrence Cole and Jeff Walden discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. Atte Kettunen discovered a buffer overflow during CSS manipulation. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. Various other issues were also addressed.