CVE-2014-1563
HighSummary
A use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1. It allows remote attackers to execute arbitrary code or cause a denial of service via an SVG animation with DOM interaction that triggers incorrect cycle collection.
Risk Assessment
Organizations may be exposed to remote attacks that could lead to unauthorized code execution or system crashes due to heap memory corruption. This poses a serious threat to the integrity and availability of systems.
Recommendation
It is recommended to update Mozilla Firefox and Thunderbird to the latest versions to mitigate this vulnerability. Additionally, monitoring and limiting the use of SVG animations in web applications may help minimize risk.
Other vulnerabilities in Mozilla Firefox, Firefox ESR, Thunderbird
See all- CVE-2016-5284High
Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning. This allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.
- CVE-2016-5278High
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
- CVE-2016-5272High
The nsImageGeometryMixin class in Mozilla Firefox before version 49.0, Firefox ESR 45.x before version 45.4, and Thunderbird before version 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, allowing remote attackers to execute arbitrary code via a crafted web site.
- CVE-2015-2740High
Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact.
- CVE-2015-2739High
The ArrayBufferBuilder::append function in Mozilla Firefox before version 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which may lead to unspecified impacts.
- CVE-2015-2738High
The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact.
- CVE-2015-2736High
The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, allowing remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2735High
The nsZipArchive.cpp file in Mozilla Firefox before version 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, allowing remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2731High
Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code.
- CVE-2015-2725High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Original NVD description (English source)
Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection.