CVE-2014-1492: Mozilla Network Security Services

Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days.

The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.

Affected products

• Mozilla Network Security Services: up to and including 3.15.5; version 3.2 only; version 3.2.1 only; version 3.3 only; version 3.3.1 only; version 3.3.2 only; …

Published 2014-03-25. Last modified 2026-06-17.