The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm.
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Linux_enterprise_desktop | Suse | 11-sp3 (including) | 11-sp3 (including) |
| Linux_enterprise_server | Suse | 11-sp3 (including) | 11-sp3 (including) |
| Linux_enterprise_software_development_kit | Suse | 11-sp3 (including) | 11-sp3 (including) |
| Firefox | Ubuntu | devel | * |
| Firefox | Ubuntu | lucid | * |
| Firefox | Ubuntu | precise | * |
| Firefox | Ubuntu | quantal | * |
| Firefox | Ubuntu | saucy | * |
| Firefox | Ubuntu | upstream | * |