CVE-2014-1531
HighSummary
A use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox, Thunderbird, and SeaMonkey before specified versions allows remote attackers to execute arbitrary code or cause a denial of service through improper handling of an imgLoader object during an image-resize operation.
Risk Assessment
An attacker could exploit this vulnerability to gain control over the system or disrupt its operation, potentially leading to serious consequences for the organization.
Recommendation
It is recommended to update Mozilla Firefox, Thunderbird, and SeaMonkey to the latest versions to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Mozilla Firefox, Thunderbird, SeaMonkey
See all- CVE-2010-3167High
The nsTreeContentView function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 does not properly handle node removal in XUL trees, allowing remote attackers to execute arbitrary code via vectors involving access to deleted memory, related to a 'dangling pointer vulnerability.'
- CVE-2010-2767High
The navigator.plugins implementation in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 does not properly handle destruction of the DOM plugin array, which might allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via crafted access to the navigator object.
- CVE-2014-1524Critical
The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects. This allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code.
Original NVD description (English source)
Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation.