Security Vulnerabilities fixed in Firefox ESR 24.3

Description

Mozilla developer Brian Smith and security researchers Antoine Delignat-Lavaud and Karthikeyan Bhargavan of the Prosecco research team at INRIA Paris reported issues with ticket handling in the Network Security Services (NSS) libraries. These have been addressed in the NSS 3.15.4 release, shipping on affected platforms.

Affected Applications

Firefox ESR

CVE References

CVE-2014-1490 CVE-2014-1491

Other References

https://www.mozilla.org/en-US/security/advisories/mfsa2014-12