CVE-2025-1014

Certificate length was not properly checked

View on CVE.org
Published Feb 4, 2025 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.

Analysis

AI-generated

Technical impact

A flaw in the certificate processing code caused the length of a certificate to be unchecked when it was added to a certificate store. Only trusted data was processed, but the improper runtime validation of the certificate length (CWE-1284) and the absence of cryptographic integrity checks (CWE-295) could allow a crafted certificate to be accepted, potentially enabling an attacker to use an unauthorized identity if the application or the underlying system is tricked into trusting that certificate.

Affected Systems

Affected products are Mozilla Firefox and Mozilla Thunderbird. Versions prior to Firefox 135, ESR 128.7, Thunderbird 135 or 128.7 are vulnerable. Red Hat Enterprise Linux packages that include these browsers are also affected, as indicated by the mentioned RHEL CPEs.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is currently very unlikely to be observed. The vulnerability is not listed in CISA KEV. Attackers would most likely need local access or the ability to influence the certificate store; without such access, the risk remains limited.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Mozilla Firefox to version 135 or newer, or to ESR 128.7 if using extended‑support releases.
  • Update Mozilla Thunderbird to version 135 or newer, or to ESR 128.7 for extended‑support releases.
  • On Red Hat Enterprise Linux systems, apply the latest security update packages that include the patched Mozilla browsers.
  • Configure system file permissions so that only privileged users can modify the certificate store, preventing unauthorized certificate installation by unprivileged users.

Generated by OpenCVE AI on April 20, 2026 at 18:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4044-1 firefox-esr security update
Debian DLA Debian DLA DLA-4045-1 thunderbird security update
Debian DSA Debian DSA DSA-5858-1 firefox-esr security update
Debian DSA Debian DSA DSA-5860-1 thunderbird security update
EUVD EUVD EUVD-2025-1969 Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
Ubuntu USN Ubuntu USN USN-7263-1 Firefox vulnerabilities
Ubuntu USN Ubuntu USN USN-7663-1 Thunderbird vulnerabilities
History
Type Values Removed Values Added
Description Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135. Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135.
Title firefox: thunderbird: Certificate length was not properly checked Certificate length was not properly checked
Type Values Removed Values Added
References
Type Values Removed Values Added
Metrics epss

{'score': 0.00049}

 epss

{'score': 0.00076}
Type Values Removed Values Added
CPEs cpe:/a:redhat:enterprise_linux:8
Type Values Removed Values Added
Title firefox: thunderbird: Certificate length was not properly checked
First Time appeared Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
Weaknesses CWE-1284
CPEs cpe:/a:redhat:enterprise_linux:9
cpe:/a:redhat:rhel_aus:8.2
cpe:/a:redhat:rhel_aus:8.4
cpe:/a:redhat:rhel_aus:8.6
cpe:/a:redhat:rhel_e4s:8.4
cpe:/a:redhat:rhel_e4s:8.6
cpe:/a:redhat:rhel_e4s:9.0
cpe:/a:redhat:rhel_eus:8.8
cpe:/a:redhat:rhel_eus:9.2
cpe:/a:redhat:rhel_eus:9.4
cpe:/a:redhat:rhel_tus:8.4
cpe:/a:redhat:rhel_tus:8.6
cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat
Redhat enterprise Linux
Redhat rhel Aus
Redhat rhel E4s
Redhat rhel Els
Redhat rhel Eus
Redhat rhel Tus
References
Metrics threat_severity

None

 threat_severity

Low
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Mozilla
Mozilla firefox
Mozilla thunderbird
Weaknesses CWE-295
CPEs cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*
Vendors & Products Mozilla
Mozilla firefox
Mozilla thunderbird
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Description Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability affects Firefox < 135, Firefox ESR < 128.7, Thunderbird < 128.7, and Thunderbird < 135.
References
Earlier changes (3)
Weaknesses
  • CWE-1284

    Improper Validation of Specified Quantity in Input

  • CWE-295

    Improper Certificate Validation

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Apr 13, 2026, 2:25 PM
Reserved
Feb 4, 2025, 7:26 AM

View source JSON

Updated
Nov 3, 2025, 8:56 PM

JSON

Status
Modified
Published
Feb 4, 2025, 2:15 PM
Modified
Oct 5, 2026, 3:10 PM

View source JSON

Severity
Low
Public date
Feb 4, 2025, 1:58 PM

View source Bugzilla JSON

Updated
Apr 20, 2026, 6:30 PM

JSON