CVE-2014-1524

Critical

Published: 30/04/2014(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects. This allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code.

Risk Assessment

This vulnerability poses a risk of malicious code execution by attackers, potentially leading to data loss or system takeover. Additionally, it may cause service outages, affecting application availability.

Recommendation

It is recommended to update Mozilla Firefox, Thunderbird, and SeaMonkey to the latest versions to mitigate this vulnerability. Monitoring and restricting access to applications should also be implemented to minimize attack risks.

Original NVD description (English source)

The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object.