CVE-2013-1740: The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3...

Security readout for executives and security teams

This flaw affected Mozilla NSS before 3.15.4 when TLS False Start was enabled. A network attacker positioned between a client and server could cause the client to accept an arbitrary certificate, undermining HTTPS server identity checks. Exposure is most likely in legacy systems, applications, appliances, or vendor products that embedded or packaged Mozilla NSS before 3.15.4 and enabled TLS False Start. The source bundle names downstream advisories from Ubuntu, openSUSE, VMware, Oracle, and Red Hat, but does not provide a complete affected product list. Treat as high priority for legacy internet-facing or sensitive client systems because it can defeat server identity validation under specific TLS conditions. It is older and not KEV-listed, so urgency should be driven by asset exposure and whether vulnerable NSS remains deployed. Mitigation focus: Upgrade Mozilla NSS to 3.15.4 or a vendor-supported fixed build.; Apply relevant OS, appliance, or application vendor advisories for CVE-2013-1740.; Inventory products that bundle NSS rather than using system packages..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.