CVE-2014-1514

Critical

Published: 19/03/2014(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In versions of Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, there is a vulnerability that does not validate the length of the destination array before a copy operation. This allows remote attackers to execute arbitrary code or cause a denial of service through incorrect use of the TypedArrayObject class.

Risk Assessment

Organizations may be exposed to remote attacks that could lead to unauthorized code execution or application crashes, potentially resulting in data loss or service interruptions.

Recommendation

It is recommended to update to the latest version of Mozilla Firefox, Thunderbird, or SeaMonkey to mitigate this vulnerability.

Original NVD description (English source)

vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.