CVE-2014-8642

CVE-2014-8642 describes a vulnerability in Mozilla Firefox before version 35.0 and SeaMonkey before 2.32, where the id-pkix-ocsp-nocheck extension is not properly considered when trusting an OCSP responder. This oversight could allow remote attackers to obtain sensitive information by sniffing network traffic if a compromised and revoked certificate is incorrectly accepted. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity, requiring no authentication, and potentially leading to partial confidentiality impact. There is no evidence of active exploitation, publicly available exploit code, or inclusion in the CISA KEV catalog, though it received limited community discussion and media coverage at the time of discovery.