CVE-2014-1578
HighSummary
The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.
Risk Assessment
This vulnerability may lead to application crashes and potential execution of malicious code, posing a serious security threat to systems using these applications.
Recommendation
It is recommended to update Mozilla Firefox and Thunderbird to the latest versions to eliminate this vulnerability and minimize the risk of attacks.
Other vulnerabilities in Mozilla Firefox, Firefox ESR, Thunderbird
See all- CVE-2016-5284High
Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 rely on unintended expiration dates for Preloaded Public Key Pinning. This allows man-in-the-middle attackers to spoof add-on updates by leveraging possession of an X.509 server certificate for addons.mozilla.org signed by an arbitrary built-in Certification Authority.
- CVE-2016-5278High
Heap-based buffer overflow in the nsBMPEncoder::AddImageFrame function in Mozilla Firefox before 49.0, Firefox ESR 45.x before 45.4, and Thunderbird < 45.4 allows remote attackers to execute arbitrary code via a crafted image data that is mishandled during the encoding of an image frame to an image.
- CVE-2016-5272High
The nsImageGeometryMixin class in Mozilla Firefox before version 49.0, Firefox ESR 45.x before version 45.4, and Thunderbird before version 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements, allowing remote attackers to execute arbitrary code via a crafted web site.
- CVE-2015-2740High
Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact.
- CVE-2015-2739High
The ArrayBufferBuilder::append function in Mozilla Firefox before version 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, which may lead to unspecified impacts.
- CVE-2015-2738High
The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact.
- CVE-2015-2736High
The nsZipArchive::BuildFileList function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, allowing remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2735High
The nsZipArchive.cpp file in Mozilla Firefox before version 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 accesses unintended memory locations, allowing remote attackers to have an unspecified impact via a crafted ZIP archive.
- CVE-2015-2731High
Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code.
- CVE-2015-2725High
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Original NVD description (English source)
The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.