CVE-2013-1740: Mozilla Network Security Services

Medium severity, CVSS 5.8. EPSS: 1.7% chance of exploitation in the next 30 days.

The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.

Affected products

• Mozilla Network Security Services: up to and including 3.15.3; version 3.2 only; version 3.2.1 only; version 3.3 only; version 3.3.1 only; version 3.3.2 only; …

Published 2014-01-18. Last modified 2026-06-16.