FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2004-0758

This CVE name corresponds to:

Entered Topic
2004-09-22 mozilla -- built-in CA certificates may be overridden

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2004-0758
Phase Assigned(20040802)

Description

Mozilla 1.5 through 1.7 allows a CA certificate to be imported even when their DN is the same as that of the built-in CA root certificate, which allows remote attackers to cause a denial of service to SSL pages because the malicious certificate is treated as invalid.

References

Source Reference
CONFIRM http://bugzilla.mozilla.org/show_bug.cgi?id=249004
CONFIRM http://www.mozilla.org/projects/security/known-vulnerabilities.html
CONFIRM https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=127186
FEDORA FLSA:2089
GENTOO GLSA-200408-22
SCO SCOSA-2005.49
CERT-VN VU#784278
REDHAT RHSA-2004:421
SUSE SUSE-SA:2004:036
BID 15495
OVAL oval:org.mitre.oval:def:3134
OVAL oval:org.mitre.oval:def:10304
XF mozilla-certificate-dos(16706)