Mozilla Foundation Security Advisory 2014-63

Use-after-free while when manipulating certificates in the trusted cache

July 22, 2014
Tyson Smith, Jesse Schwartzentruber
Firefox, Firefox ESR, Thunderbird
Fixed in
  • Firefox 31
  • Firefox ESR 24.7
  • Thunderbird 24.7
  • Thunderbird 31


Security researchers Tyson Smith and Jesse Schwartzentruber used the Address Sanitizer tool while fuzzing to discover a use-after-free error resulting in a crash. This is a result of a pair of NSSCertificate structures being added to a trust domain and then one of them is removed while they are still in use by the trusted cache. This crash is potentially exploitable.

This issue was addressed in the Network Security Services (NSS) library in version 3.16.2, shipping on affected platforms.

In general this flaw cannot be exploited through email in the Thunderbird product because scripting is disabled, but is potentially a risk in browser or browser-like contexts.