Vulnerability-Lookup

RHSA-2014:1635

Vulnerability from csaf_opensuse - Published: 2014-10-14 00:00 - Updated: 2026-09-20 10:53

Summary

security update for firefox

Severity

Critical

Notes

Title of the patch: security update for firefox

Description of the patch: This security update provides a functional equivalent of RHSA-2014:1635. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2014:1635.

Patchnames: RHSA-2014:1635

CVE-2014-1574

Affected products

Recommended 6 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2014-1576

Affected products

Recommended 6 products, the same list as for CVE-2014-1574

Threats

Impact moderate

CVE-2014-1577

Affected products

Recommended 6 products, the same list as for CVE-2014-1574

Threats

Impact moderate

CVE-2014-1578

Affected products

Recommended 6 products, the same list as for CVE-2014-1574

Threats

Impact moderate

CVE-2014-1581

Affected products

Recommended 6 products, the same list as for CVE-2014-1574

Threats

Impact moderate

CVE-2014-1583

Affected products

Recommended 6 products, the same list as for CVE-2014-1574

Threats

Impact moderate

References

20 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/r…	self
https://www.suse.com/security/cve/CVE-2014-1574/	self
https://www.suse.com/security/cve/CVE-2014-1576/	self
https://www.suse.com/security/cve/CVE-2014-1577/	self
https://www.suse.com/security/cve/CVE-2014-1578/	self
https://www.suse.com/security/cve/CVE-2014-1581/	self
https://www.suse.com/security/cve/CVE-2014-1583/	self
https://www.suse.com/security/cve/CVE-2014-1574	external
https://bugzilla.suse.com/900941	external
https://www.suse.com/security/cve/CVE-2014-1576	external
https://bugzilla.suse.com/900941	external
https://www.suse.com/security/cve/CVE-2014-1577	external
https://bugzilla.suse.com/900941	external
https://www.suse.com/security/cve/CVE-2014-1578	external
https://bugzilla.suse.com/900941	external
https://www.suse.com/security/cve/CVE-2014-1581	external
https://bugzilla.suse.com/900941	external
https://www.suse.com/security/cve/CVE-2014-1583	external
https://bugzilla.suse.com/900941	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for firefox",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2014:1635.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2014:1635.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2014:1635",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2014_1635.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-1574 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-1574/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-1576 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-1576/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-1577 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-1577/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-1578 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-1578/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-1581 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-1581/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2014-1583 page",
        "url": "https://www.suse.com/security/cve/CVE-2014-1583/"
      }
    ],
    "title": "security update for firefox",
    "tracking": {
      "current_release_date": "2026-09-20T10:53:15Z",
      "generator": {
        "date": "2014-10-14T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2014:1635",
      "initial_release_date": "2014-10-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2014-10-14T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T10:53:15Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:31.2.0-3.el7_0.i686",
                "product": {
                  "name": "firefox-0:31.2.0-3.el7_0.i686",
                  "product_id": "firefox-0:31.2.0-3.el7_0.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/firefox@31.2.0-3.el7_0?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xulrunner-0:31.2.0-1.el7_0.i686",
                "product": {
                  "name": "xulrunner-0:31.2.0-1.el7_0.i686",
                  "product_id": "xulrunner-0:31.2.0-1.el7_0.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/xulrunner@31.2.0-1.el7_0?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xulrunner-devel-0:31.2.0-1.el7_0.i686",
                "product": {
                  "name": "xulrunner-devel-0:31.2.0-1.el7_0.i686",
                  "product_id": "xulrunner-devel-0:31.2.0-1.el7_0.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/xulrunner-devel@31.2.0-1.el7_0?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:31.2.0-3.el7_0.x86_64",
                "product": {
                  "name": "firefox-0:31.2.0-3.el7_0.x86_64",
                  "product_id": "firefox-0:31.2.0-3.el7_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/firefox@31.2.0-3.el7_0?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xulrunner-0:31.2.0-1.el7_0.x86_64",
                "product": {
                  "name": "xulrunner-0:31.2.0-1.el7_0.x86_64",
                  "product_id": "xulrunner-0:31.2.0-1.el7_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/xulrunner@31.2.0-1.el7_0?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "xulrunner-devel-0:31.2.0-1.el7_0.x86_64",
                "product": {
                  "name": "xulrunner-devel-0:31.2.0-1.el7_0.x86_64",
                  "product_id": "xulrunner-devel-0:31.2.0-1.el7_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/xulrunner-devel@31.2.0-1.el7_0?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 7",
                "product": {
                  "name": "SUSE Liberty Linux 7",
                  "product_id": "SUSE Liberty Linux 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:31.2.0-3.el7_0.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686"
        },
        "product_reference": "firefox-0:31.2.0-3.el7_0.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:31.2.0-3.el7_0.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64"
        },
        "product_reference": "firefox-0:31.2.0-3.el7_0.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xulrunner-0:31.2.0-1.el7_0.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686"
        },
        "product_reference": "xulrunner-0:31.2.0-1.el7_0.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xulrunner-0:31.2.0-1.el7_0.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64"
        },
        "product_reference": "xulrunner-0:31.2.0-1.el7_0.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xulrunner-devel-0:31.2.0-1.el7_0.i686 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686"
        },
        "product_reference": "xulrunner-devel-0:31.2.0-1.el7_0.i686",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xulrunner-devel-0:31.2.0-1.el7_0.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
        },
        "product_reference": "xulrunner-devel-0:31.2.0-1.el7_0.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2014-1574",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-1574"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-1574",
          "url": "https://www.suse.com/security/cve/CVE-2014-1574"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 900941 for CVE-2014-1574",
          "url": "https://bugzilla.suse.com/900941"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2014-10-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-1574"
    },
    {
      "cve": "CVE-2014-1576",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-1576"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-1576",
          "url": "https://www.suse.com/security/cve/CVE-2014-1576"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 900941 for CVE-2014-1576",
          "url": "https://bugzilla.suse.com/900941"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2014-10-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-1576"
    },
    {
      "cve": "CVE-2014-1577",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-1577"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-1577",
          "url": "https://www.suse.com/security/cve/CVE-2014-1577"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 900941 for CVE-2014-1577",
          "url": "https://bugzilla.suse.com/900941"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2014-10-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-1577"
    },
    {
      "cve": "CVE-2014-1578",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-1578"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-1578",
          "url": "https://www.suse.com/security/cve/CVE-2014-1578"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 900941 for CVE-2014-1578",
          "url": "https://bugzilla.suse.com/900941"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2014-10-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-1578"
    },
    {
      "cve": "CVE-2014-1581",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-1581"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-1581",
          "url": "https://www.suse.com/security/cve/CVE-2014-1581"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 900941 for CVE-2014-1581",
          "url": "https://bugzilla.suse.com/900941"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2014-10-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-1581"
    },
    {
      "cve": "CVE-2014-1583",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2014-1583"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
          "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
          "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2014-1583",
          "url": "https://www.suse.com/security/cve/CVE-2014-1583"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 900941 for CVE-2014-1583",
          "url": "https://bugzilla.suse.com/900941"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.i686",
            "SUSE Liberty Linux 7:firefox-0:31.2.0-3.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-0:31.2.0-1.el7_0.x86_64",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.i686",
            "SUSE Liberty Linux 7:xulrunner-devel-0:31.2.0-1.el7_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2014-10-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2014-1583"
    }
  ]
}

CVE-2014-1574 (GCVE-0-2014-1574)

Vulnerability from cvelistv5 – Published: 2014-10-15 10:00 – Updated: 2024-08-06 09:42

Summary

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.

Severity

No CVSS data available.

CWE

Assigner

mozilla mitre root

References

32 references

URL	Tags
http://www.mozilla.org/security/announce/2014/mfs…	x_refsource_CONFIRM
http://secunia.com/advisories/62021	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
https://bugzilla.mozilla.org/show_bug.cgi?id=1064346	x_refsource_CONFIRM
http://www.securitytracker.com/id/1031028	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.ubuntu.com/usn/USN-2373-1	vendor-advisoryx_refsource_UBUNTU
https://advisories.mageia.org/MGASA-2014-0421.html	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201504-01	vendor-advisoryx_refsource_GENTOO
https://bugzilla.mozilla.org/show_bug.cgi?id=1061214	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2014-1635.html	vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://rhn.redhat.com/errata/RHSA-2014-1647.html	vendor-advisoryx_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=1061600	x_refsource_CONFIRM
https://bugzilla.mozilla.org/show_bug.cgi?id=1011354	x_refsource_CONFIRM
http://secunia.com/advisories/61387	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-2372-1	vendor-advisoryx_refsource_UBUNTU
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
https://bugzilla.mozilla.org/show_bug.cgi?id=1072174	x_refsource_CONFIRM
http://secunia.com/advisories/62022	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securitytracker.com/id/1031030	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/62023	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
https://bugzilla.mozilla.org/show_bug.cgi?id=1072044	x_refsource_CONFIRM
http://www.debian.org/security/2014/dsa-3050	vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/61854	third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/70436	vdb-entryx_refsource_BID
http://www.debian.org/security/2014/dsa-3061	vendor-advisoryx_refsource_DEBIAN

Date Public

2014-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:42:36.627Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-74.html"
          },
          {
            "name": "62021",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62021"
          },
          {
            "name": "openSUSE-SU-2015:0138",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
          },
          {
            "name": "openSUSE-SU-2014:1344",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
          },
          {
            "name": "openSUSE-SU-2014:1346",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
          },
          {
            "name": "FEDORA-2014-13042",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1064346"
          },
          {
            "name": "1031028",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031028"
          },
          {
            "name": "openSUSE-SU-2014:1345",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
          },
          {
            "name": "USN-2373-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2373-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
          },
          {
            "name": "GLSA-201504-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201504-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1061214"
          },
          {
            "name": "RHSA-2014:1635",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
          },
          {
            "name": "FEDORA-2014-14084",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
          },
          {
            "name": "RHSA-2014:1647",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1061600"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1011354"
          },
          {
            "name": "61387",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61387"
          },
          {
            "name": "USN-2372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2372-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1072174"
          },
          {
            "name": "62022",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62022"
          },
          {
            "name": "openSUSE-SU-2015:1266",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
          },
          {
            "name": "1031030",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031030"
          },
          {
            "name": "62023",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62023"
          },
          {
            "name": "openSUSE-SU-2014:1343",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1072044"
          },
          {
            "name": "DSA-3050",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3050"
          },
          {
            "name": "61854",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61854"
          },
          {
            "name": "70436",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70436"
          },
          {
            "name": "DSA-3061",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3061"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-22T18:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-74.html"
        },
        {
          "name": "62021",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62021"
        },
        {
          "name": "openSUSE-SU-2015:0138",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
        },
        {
          "name": "openSUSE-SU-2014:1344",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
        },
        {
          "name": "openSUSE-SU-2014:1346",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
        },
        {
          "name": "FEDORA-2014-13042",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1064346"
        },
        {
          "name": "1031028",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031028"
        },
        {
          "name": "openSUSE-SU-2014:1345",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
        },
        {
          "name": "USN-2373-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2373-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
        },
        {
          "name": "GLSA-201504-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201504-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1061214"
        },
        {
          "name": "RHSA-2014:1635",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
        },
        {
          "name": "FEDORA-2014-14084",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
        },
        {
          "name": "RHSA-2014:1647",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1061600"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1011354"
        },
        {
          "name": "61387",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61387"
        },
        {
          "name": "USN-2372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2372-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1072174"
        },
        {
          "name": "62022",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62022"
        },
        {
          "name": "openSUSE-SU-2015:1266",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
        },
        {
          "name": "1031030",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031030"
        },
        {
          "name": "62023",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62023"
        },
        {
          "name": "openSUSE-SU-2014:1343",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1072044"
        },
        {
          "name": "DSA-3050",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3050"
        },
        {
          "name": "61854",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61854"
        },
        {
          "name": "70436",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70436"
        },
        {
          "name": "DSA-3061",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3061"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2014-1574",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.mozilla.org/security/announce/2014/mfsa2014-74.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-74.html"
            },
            {
              "name": "62021",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62021"
            },
            {
              "name": "openSUSE-SU-2015:0138",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
            },
            {
              "name": "openSUSE-SU-2014:1344",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
            },
            {
              "name": "openSUSE-SU-2014:1346",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
            },
            {
              "name": "FEDORA-2014-13042",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1064346",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1064346"
            },
            {
              "name": "1031028",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031028"
            },
            {
              "name": "openSUSE-SU-2014:1345",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
            },
            {
              "name": "USN-2373-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2373-1"
            },
            {
              "name": "https://advisories.mageia.org/MGASA-2014-0421.html",
              "refsource": "CONFIRM",
              "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
            },
            {
              "name": "GLSA-201504-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201504-01"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1061214",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1061214"
            },
            {
              "name": "RHSA-2014:1635",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
            },
            {
              "name": "FEDORA-2014-14084",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
            },
            {
              "name": "RHSA-2014:1647",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1061600",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1061600"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1011354",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1011354"
            },
            {
              "name": "61387",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61387"
            },
            {
              "name": "USN-2372-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2372-1"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1072174",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1072174"
            },
            {
              "name": "62022",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62022"
            },
            {
              "name": "openSUSE-SU-2015:1266",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
            },
            {
              "name": "1031030",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031030"
            },
            {
              "name": "62023",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62023"
            },
            {
              "name": "openSUSE-SU-2014:1343",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1072044",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1072044"
            },
            {
              "name": "DSA-3050",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3050"
            },
            {
              "name": "61854",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61854"
            },
            {
              "name": "70436",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70436"
            },
            {
              "name": "DSA-3061",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3061"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2014-1574",
    "datePublished": "2014-10-15T10:00:00.000Z",
    "dateReserved": "2014-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:42:36.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-1576 (GCVE-0-2014-1576)

Vulnerability from cvelistv5 – Published: 2014-10-15 10:00 – Updated: 2024-08-06 09:42

Summary

Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style.

Severity

No CVSS data available.

CWE

Assigner

mozilla mitre root

References

26 references

URL	Tags
http://secunia.com/advisories/62021	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.securitytracker.com/id/1031028	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.mozilla.org/security/announce/2014/mfs…	x_refsource_CONFIRM
http://www.ubuntu.com/usn/USN-2373-1	vendor-advisoryx_refsource_UBUNTU
https://advisories.mageia.org/MGASA-2014-0421.html	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201504-01	vendor-advisoryx_refsource_GENTOO
http://rhn.redhat.com/errata/RHSA-2014-1635.html	vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
https://bugzilla.mozilla.org/show_bug.cgi?id=1041512	x_refsource_CONFIRM
http://secunia.com/advisories/61387	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-2372-1	vendor-advisoryx_refsource_UBUNTU
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://secunia.com/advisories/62022	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securitytracker.com/id/1031030	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/62023	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.debian.org/security/2014/dsa-3050	vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/61854	third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2014/dsa-3061	vendor-advisoryx_refsource_DEBIAN
http://www.securityfocus.com/bid/70430	vdb-entryx_refsource_BID

Date Public

2014-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:42:36.219Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "62021",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62021"
          },
          {
            "name": "openSUSE-SU-2015:0138",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
          },
          {
            "name": "openSUSE-SU-2014:1344",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
          },
          {
            "name": "openSUSE-SU-2014:1346",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
          },
          {
            "name": "FEDORA-2014-13042",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
          },
          {
            "name": "1031028",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031028"
          },
          {
            "name": "openSUSE-SU-2014:1345",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-75.html"
          },
          {
            "name": "USN-2373-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2373-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
          },
          {
            "name": "GLSA-201504-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201504-01"
          },
          {
            "name": "RHSA-2014:1635",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
          },
          {
            "name": "FEDORA-2014-14084",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1041512"
          },
          {
            "name": "61387",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61387"
          },
          {
            "name": "USN-2372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2372-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
          },
          {
            "name": "62022",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62022"
          },
          {
            "name": "openSUSE-SU-2015:1266",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
          },
          {
            "name": "1031030",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031030"
          },
          {
            "name": "62023",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62023"
          },
          {
            "name": "openSUSE-SU-2014:1343",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
          },
          {
            "name": "DSA-3050",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3050"
          },
          {
            "name": "61854",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61854"
          },
          {
            "name": "DSA-3061",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3061"
          },
          {
            "name": "70430",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70430"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-22T18:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "62021",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62021"
        },
        {
          "name": "openSUSE-SU-2015:0138",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
        },
        {
          "name": "openSUSE-SU-2014:1344",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
        },
        {
          "name": "openSUSE-SU-2014:1346",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
        },
        {
          "name": "FEDORA-2014-13042",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
        },
        {
          "name": "1031028",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031028"
        },
        {
          "name": "openSUSE-SU-2014:1345",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-75.html"
        },
        {
          "name": "USN-2373-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2373-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
        },
        {
          "name": "GLSA-201504-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201504-01"
        },
        {
          "name": "RHSA-2014:1635",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
        },
        {
          "name": "FEDORA-2014-14084",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1041512"
        },
        {
          "name": "61387",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61387"
        },
        {
          "name": "USN-2372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2372-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
        },
        {
          "name": "62022",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62022"
        },
        {
          "name": "openSUSE-SU-2015:1266",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
        },
        {
          "name": "1031030",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031030"
        },
        {
          "name": "62023",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62023"
        },
        {
          "name": "openSUSE-SU-2014:1343",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
        },
        {
          "name": "DSA-3050",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3050"
        },
        {
          "name": "61854",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61854"
        },
        {
          "name": "DSA-3061",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3061"
        },
        {
          "name": "70430",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70430"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2014-1576",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "62021",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62021"
            },
            {
              "name": "openSUSE-SU-2015:0138",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
            },
            {
              "name": "openSUSE-SU-2014:1344",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
            },
            {
              "name": "openSUSE-SU-2014:1346",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
            },
            {
              "name": "FEDORA-2014-13042",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
            },
            {
              "name": "1031028",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031028"
            },
            {
              "name": "openSUSE-SU-2014:1345",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2014/mfsa2014-75.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-75.html"
            },
            {
              "name": "USN-2373-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2373-1"
            },
            {
              "name": "https://advisories.mageia.org/MGASA-2014-0421.html",
              "refsource": "CONFIRM",
              "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
            },
            {
              "name": "GLSA-201504-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201504-01"
            },
            {
              "name": "RHSA-2014:1635",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
            },
            {
              "name": "FEDORA-2014-14084",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1041512",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1041512"
            },
            {
              "name": "61387",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61387"
            },
            {
              "name": "USN-2372-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2372-1"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
            },
            {
              "name": "62022",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62022"
            },
            {
              "name": "openSUSE-SU-2015:1266",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
            },
            {
              "name": "1031030",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031030"
            },
            {
              "name": "62023",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62023"
            },
            {
              "name": "openSUSE-SU-2014:1343",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
            },
            {
              "name": "DSA-3050",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3050"
            },
            {
              "name": "61854",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61854"
            },
            {
              "name": "DSA-3061",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3061"
            },
            {
              "name": "70430",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70430"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2014-1576",
    "datePublished": "2014-10-15T10:00:00.000Z",
    "dateReserved": "2014-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:42:36.219Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-1577 (GCVE-0-2014-1577)

Vulnerability from cvelistv5 – Published: 2014-10-15 10:00 – Updated: 2024-08-06 09:42

Summary

The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value.

Severity

No CVSS data available.

CWE

Assigner

mozilla mitre root

References

27 references

URL	Tags
http://www.mozilla.org/security/announce/2014/mfs…	x_refsource_CONFIRM
http://secunia.com/advisories/62021	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
https://bugzilla.mozilla.org/show_bug.cgi?id=1012609	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.securitytracker.com/id/1031028	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.ubuntu.com/usn/USN-2373-1	vendor-advisoryx_refsource_UBUNTU
https://advisories.mageia.org/MGASA-2014-0421.html	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201504-01	vendor-advisoryx_refsource_GENTOO
http://rhn.redhat.com/errata/RHSA-2014-1635.html	vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://rhn.redhat.com/errata/RHSA-2014-1647.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/61387	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-2372-1	vendor-advisoryx_refsource_UBUNTU
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://secunia.com/advisories/62022	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securitytracker.com/id/1031030	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/62023	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/70440	vdb-entryx_refsource_BID
http://www.debian.org/security/2014/dsa-3050	vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/61854	third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2014/dsa-3061	vendor-advisoryx_refsource_DEBIAN

Date Public

2014-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:42:36.631Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-76.html"
          },
          {
            "name": "62021",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62021"
          },
          {
            "name": "openSUSE-SU-2015:0138",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
          },
          {
            "name": "openSUSE-SU-2014:1344",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1012609"
          },
          {
            "name": "openSUSE-SU-2014:1346",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
          },
          {
            "name": "FEDORA-2014-13042",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
          },
          {
            "name": "1031028",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031028"
          },
          {
            "name": "openSUSE-SU-2014:1345",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
          },
          {
            "name": "USN-2373-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2373-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
          },
          {
            "name": "GLSA-201504-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201504-01"
          },
          {
            "name": "RHSA-2014:1635",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
          },
          {
            "name": "FEDORA-2014-14084",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
          },
          {
            "name": "RHSA-2014:1647",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
          },
          {
            "name": "61387",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61387"
          },
          {
            "name": "USN-2372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2372-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
          },
          {
            "name": "62022",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62022"
          },
          {
            "name": "openSUSE-SU-2015:1266",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
          },
          {
            "name": "1031030",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031030"
          },
          {
            "name": "62023",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62023"
          },
          {
            "name": "openSUSE-SU-2014:1343",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
          },
          {
            "name": "70440",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70440"
          },
          {
            "name": "DSA-3050",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3050"
          },
          {
            "name": "61854",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61854"
          },
          {
            "name": "DSA-3061",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3061"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-22T18:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-76.html"
        },
        {
          "name": "62021",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62021"
        },
        {
          "name": "openSUSE-SU-2015:0138",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
        },
        {
          "name": "openSUSE-SU-2014:1344",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1012609"
        },
        {
          "name": "openSUSE-SU-2014:1346",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
        },
        {
          "name": "FEDORA-2014-13042",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
        },
        {
          "name": "1031028",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031028"
        },
        {
          "name": "openSUSE-SU-2014:1345",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
        },
        {
          "name": "USN-2373-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2373-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
        },
        {
          "name": "GLSA-201504-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201504-01"
        },
        {
          "name": "RHSA-2014:1635",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
        },
        {
          "name": "FEDORA-2014-14084",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
        },
        {
          "name": "RHSA-2014:1647",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
        },
        {
          "name": "61387",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61387"
        },
        {
          "name": "USN-2372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2372-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
        },
        {
          "name": "62022",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62022"
        },
        {
          "name": "openSUSE-SU-2015:1266",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
        },
        {
          "name": "1031030",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031030"
        },
        {
          "name": "62023",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62023"
        },
        {
          "name": "openSUSE-SU-2014:1343",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
        },
        {
          "name": "70440",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70440"
        },
        {
          "name": "DSA-3050",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3050"
        },
        {
          "name": "61854",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61854"
        },
        {
          "name": "DSA-3061",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3061"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2014-1577",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via an invalid custom waveform that triggers a calculation of a negative frequency value."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.mozilla.org/security/announce/2014/mfsa2014-76.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-76.html"
            },
            {
              "name": "62021",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62021"
            },
            {
              "name": "openSUSE-SU-2015:0138",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
            },
            {
              "name": "openSUSE-SU-2014:1344",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1012609",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1012609"
            },
            {
              "name": "openSUSE-SU-2014:1346",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
            },
            {
              "name": "FEDORA-2014-13042",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
            },
            {
              "name": "1031028",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031028"
            },
            {
              "name": "openSUSE-SU-2014:1345",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
            },
            {
              "name": "USN-2373-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2373-1"
            },
            {
              "name": "https://advisories.mageia.org/MGASA-2014-0421.html",
              "refsource": "CONFIRM",
              "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
            },
            {
              "name": "GLSA-201504-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201504-01"
            },
            {
              "name": "RHSA-2014:1635",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
            },
            {
              "name": "FEDORA-2014-14084",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
            },
            {
              "name": "RHSA-2014:1647",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
            },
            {
              "name": "61387",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61387"
            },
            {
              "name": "USN-2372-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2372-1"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
            },
            {
              "name": "62022",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62022"
            },
            {
              "name": "openSUSE-SU-2015:1266",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
            },
            {
              "name": "1031030",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031030"
            },
            {
              "name": "62023",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62023"
            },
            {
              "name": "openSUSE-SU-2014:1343",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
            },
            {
              "name": "70440",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70440"
            },
            {
              "name": "DSA-3050",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3050"
            },
            {
              "name": "61854",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61854"
            },
            {
              "name": "DSA-3061",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3061"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2014-1577",
    "datePublished": "2014-10-15T10:00:00.000Z",
    "dateReserved": "2014-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:42:36.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-1578 (GCVE-0-2014-1578)

Vulnerability from cvelistv5 – Published: 2014-10-15 10:00 – Updated: 2024-08-06 09:42

Summary

The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.

Severity

No CVSS data available.

CWE

Assigner

mozilla mitre root

References

27 references

URL	Tags
http://secunia.com/advisories/62021	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.securitytracker.com/id/1031028	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.ubuntu.com/usn/USN-2373-1	vendor-advisoryx_refsource_UBUNTU
https://advisories.mageia.org/MGASA-2014-0421.html	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201504-01	vendor-advisoryx_refsource_GENTOO
https://bugzilla.mozilla.org/show_bug.cgi?id=1063327	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2014-1635.html	vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://rhn.redhat.com/errata/RHSA-2014-1647.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/61387	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-2372-1	vendor-advisoryx_refsource_UBUNTU
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://secunia.com/advisories/62022	third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/70428	vdb-entryx_refsource_BID
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securitytracker.com/id/1031030	vdb-entryx_refsource_SECTRACK
http://www.mozilla.org/security/announce/2014/mfs…	x_refsource_CONFIRM
http://secunia.com/advisories/62023	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.debian.org/security/2014/dsa-3050	vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/61854	third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2014/dsa-3061	vendor-advisoryx_refsource_DEBIAN

Date Public

2014-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:42:36.668Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "62021",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62021"
          },
          {
            "name": "openSUSE-SU-2015:0138",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
          },
          {
            "name": "openSUSE-SU-2014:1344",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
          },
          {
            "name": "openSUSE-SU-2014:1346",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
          },
          {
            "name": "FEDORA-2014-13042",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
          },
          {
            "name": "1031028",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031028"
          },
          {
            "name": "openSUSE-SU-2014:1345",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
          },
          {
            "name": "USN-2373-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2373-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
          },
          {
            "name": "GLSA-201504-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201504-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1063327"
          },
          {
            "name": "RHSA-2014:1635",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
          },
          {
            "name": "FEDORA-2014-14084",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
          },
          {
            "name": "RHSA-2014:1647",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
          },
          {
            "name": "61387",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61387"
          },
          {
            "name": "USN-2372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2372-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
          },
          {
            "name": "62022",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62022"
          },
          {
            "name": "70428",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70428"
          },
          {
            "name": "openSUSE-SU-2015:1266",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
          },
          {
            "name": "1031030",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031030"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-77.html"
          },
          {
            "name": "62023",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62023"
          },
          {
            "name": "openSUSE-SU-2014:1343",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
          },
          {
            "name": "DSA-3050",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3050"
          },
          {
            "name": "61854",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61854"
          },
          {
            "name": "DSA-3061",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3061"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-22T18:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "62021",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62021"
        },
        {
          "name": "openSUSE-SU-2015:0138",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
        },
        {
          "name": "openSUSE-SU-2014:1344",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
        },
        {
          "name": "openSUSE-SU-2014:1346",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
        },
        {
          "name": "FEDORA-2014-13042",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
        },
        {
          "name": "1031028",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031028"
        },
        {
          "name": "openSUSE-SU-2014:1345",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
        },
        {
          "name": "USN-2373-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2373-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
        },
        {
          "name": "GLSA-201504-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201504-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1063327"
        },
        {
          "name": "RHSA-2014:1635",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
        },
        {
          "name": "FEDORA-2014-14084",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
        },
        {
          "name": "RHSA-2014:1647",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
        },
        {
          "name": "61387",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61387"
        },
        {
          "name": "USN-2372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2372-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
        },
        {
          "name": "62022",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62022"
        },
        {
          "name": "70428",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70428"
        },
        {
          "name": "openSUSE-SU-2015:1266",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
        },
        {
          "name": "1031030",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031030"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-77.html"
        },
        {
          "name": "62023",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62023"
        },
        {
          "name": "openSUSE-SU-2014:1343",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
        },
        {
          "name": "DSA-3050",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3050"
        },
        {
          "name": "61854",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61854"
        },
        {
          "name": "DSA-3061",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3061"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2014-1578",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "62021",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62021"
            },
            {
              "name": "openSUSE-SU-2015:0138",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
            },
            {
              "name": "openSUSE-SU-2014:1344",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
            },
            {
              "name": "openSUSE-SU-2014:1346",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
            },
            {
              "name": "FEDORA-2014-13042",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
            },
            {
              "name": "1031028",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031028"
            },
            {
              "name": "openSUSE-SU-2014:1345",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
            },
            {
              "name": "USN-2373-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2373-1"
            },
            {
              "name": "https://advisories.mageia.org/MGASA-2014-0421.html",
              "refsource": "CONFIRM",
              "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
            },
            {
              "name": "GLSA-201504-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201504-01"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1063327",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1063327"
            },
            {
              "name": "RHSA-2014:1635",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
            },
            {
              "name": "FEDORA-2014-14084",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
            },
            {
              "name": "RHSA-2014:1647",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
            },
            {
              "name": "61387",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61387"
            },
            {
              "name": "USN-2372-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2372-1"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
            },
            {
              "name": "62022",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62022"
            },
            {
              "name": "70428",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70428"
            },
            {
              "name": "openSUSE-SU-2015:1266",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
            },
            {
              "name": "1031030",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031030"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2014/mfsa2014-77.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-77.html"
            },
            {
              "name": "62023",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62023"
            },
            {
              "name": "openSUSE-SU-2014:1343",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
            },
            {
              "name": "DSA-3050",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3050"
            },
            {
              "name": "61854",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61854"
            },
            {
              "name": "DSA-3061",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3061"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2014-1578",
    "datePublished": "2014-10-15T10:00:00.000Z",
    "dateReserved": "2014-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:42:36.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-1581 (GCVE-0-2014-1581)

Vulnerability from cvelistv5 – Published: 2014-10-15 10:00 – Updated: 2024-08-06 09:42

Summary

Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.

Severity

No CVSS data available.

CWE

Assigner

mozilla mitre root

References

27 references

URL	Tags
http://secunia.com/advisories/62021	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.securitytracker.com/id/1031028	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.ubuntu.com/usn/USN-2373-1	vendor-advisoryx_refsource_UBUNTU
https://advisories.mageia.org/MGASA-2014-0421.html	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201504-01	vendor-advisoryx_refsource_GENTOO
https://bugzilla.mozilla.org/show_bug.cgi?id=1068218	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2014-1635.html	vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://rhn.redhat.com/errata/RHSA-2014-1647.html	vendor-advisoryx_refsource_REDHAT
http://secunia.com/advisories/61387	third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-2372-1	vendor-advisoryx_refsource_UBUNTU
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://secunia.com/advisories/62022	third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/70426	vdb-entryx_refsource_BID
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.securitytracker.com/id/1031030	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/62023	third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.mozilla.org/security/announce/2014/mfs…	x_refsource_CONFIRM
http://www.debian.org/security/2014/dsa-3050	vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/61854	third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2014/dsa-3061	vendor-advisoryx_refsource_DEBIAN

Date Public

2014-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:42:36.648Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "62021",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62021"
          },
          {
            "name": "openSUSE-SU-2015:0138",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
          },
          {
            "name": "openSUSE-SU-2014:1344",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
          },
          {
            "name": "openSUSE-SU-2014:1346",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
          },
          {
            "name": "FEDORA-2014-13042",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
          },
          {
            "name": "1031028",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031028"
          },
          {
            "name": "openSUSE-SU-2014:1345",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
          },
          {
            "name": "USN-2373-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2373-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
          },
          {
            "name": "GLSA-201504-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201504-01"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1068218"
          },
          {
            "name": "RHSA-2014:1635",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
          },
          {
            "name": "FEDORA-2014-14084",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
          },
          {
            "name": "RHSA-2014:1647",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
          },
          {
            "name": "61387",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61387"
          },
          {
            "name": "USN-2372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2372-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
          },
          {
            "name": "62022",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62022"
          },
          {
            "name": "70426",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70426"
          },
          {
            "name": "openSUSE-SU-2015:1266",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
          },
          {
            "name": "1031030",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031030"
          },
          {
            "name": "62023",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62023"
          },
          {
            "name": "openSUSE-SU-2014:1343",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-79.html"
          },
          {
            "name": "DSA-3050",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3050"
          },
          {
            "name": "61854",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61854"
          },
          {
            "name": "DSA-3061",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3061"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-22T18:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "62021",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62021"
        },
        {
          "name": "openSUSE-SU-2015:0138",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
        },
        {
          "name": "openSUSE-SU-2014:1344",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
        },
        {
          "name": "openSUSE-SU-2014:1346",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
        },
        {
          "name": "FEDORA-2014-13042",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
        },
        {
          "name": "1031028",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031028"
        },
        {
          "name": "openSUSE-SU-2014:1345",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
        },
        {
          "name": "USN-2373-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2373-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
        },
        {
          "name": "GLSA-201504-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201504-01"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1068218"
        },
        {
          "name": "RHSA-2014:1635",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
        },
        {
          "name": "FEDORA-2014-14084",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
        },
        {
          "name": "RHSA-2014:1647",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
        },
        {
          "name": "61387",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61387"
        },
        {
          "name": "USN-2372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2372-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
        },
        {
          "name": "62022",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62022"
        },
        {
          "name": "70426",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70426"
        },
        {
          "name": "openSUSE-SU-2015:1266",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
        },
        {
          "name": "1031030",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031030"
        },
        {
          "name": "62023",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62023"
        },
        {
          "name": "openSUSE-SU-2014:1343",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-79.html"
        },
        {
          "name": "DSA-3050",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3050"
        },
        {
          "name": "61854",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61854"
        },
        {
          "name": "DSA-3061",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3061"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2014-1581",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "62021",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62021"
            },
            {
              "name": "openSUSE-SU-2015:0138",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"
            },
            {
              "name": "openSUSE-SU-2014:1344",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
            },
            {
              "name": "openSUSE-SU-2014:1346",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"
            },
            {
              "name": "FEDORA-2014-13042",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
            },
            {
              "name": "1031028",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031028"
            },
            {
              "name": "openSUSE-SU-2014:1345",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
            },
            {
              "name": "USN-2373-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2373-1"
            },
            {
              "name": "https://advisories.mageia.org/MGASA-2014-0421.html",
              "refsource": "CONFIRM",
              "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
            },
            {
              "name": "GLSA-201504-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201504-01"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1068218",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1068218"
            },
            {
              "name": "RHSA-2014:1635",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
            },
            {
              "name": "FEDORA-2014-14084",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
            },
            {
              "name": "RHSA-2014:1647",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1647.html"
            },
            {
              "name": "61387",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61387"
            },
            {
              "name": "USN-2372-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2372-1"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
            },
            {
              "name": "62022",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62022"
            },
            {
              "name": "70426",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70426"
            },
            {
              "name": "openSUSE-SU-2015:1266",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"
            },
            {
              "name": "1031030",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031030"
            },
            {
              "name": "62023",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62023"
            },
            {
              "name": "openSUSE-SU-2014:1343",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2014/mfsa2014-79.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-79.html"
            },
            {
              "name": "DSA-3050",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3050"
            },
            {
              "name": "61854",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61854"
            },
            {
              "name": "DSA-3061",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3061"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2014-1581",
    "datePublished": "2014-10-15T10:00:00.000Z",
    "dateReserved": "2014-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:42:36.648Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-1583 (GCVE-0-2014-1583)

Vulnerability from cvelistv5 – Published: 2014-10-15 10:00 – Updated: 2024-08-06 09:42

Summary

The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm.

Severity

No CVSS data available.

CWE

Assigner

mozilla mitre root

References

18 references

URL	Tags
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.securitytracker.com/id/1031028	vdb-entryx_refsource_SECTRACK
http://lists.opensuse.org/opensuse-updates/2014-1…	vendor-advisoryx_refsource_SUSE
http://www.mozilla.org/security/announce/2014/mfs…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/70424	vdb-entryx_refsource_BID
https://advisories.mageia.org/MGASA-2014-0421.html	x_refsource_CONFIRM
https://security.gentoo.org/glsa/201504-01	vendor-advisoryx_refsource_GENTOO
http://rhn.redhat.com/errata/RHSA-2014-1635.html	vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-…	vendor-advisoryx_refsource_FEDORA
http://www.ubuntu.com/usn/USN-2372-1	vendor-advisoryx_refsource_UBUNTU
http://www.oracle.com/technetwork/topics/security…	x_refsource_CONFIRM
http://secunia.com/advisories/62022	third-party-advisoryx_refsource_SECUNIA
http://www.securitytracker.com/id/1031030	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/62023	third-party-advisoryx_refsource_SECUNIA
https://bugzilla.mozilla.org/show_bug.cgi?id=1015540	x_refsource_CONFIRM
http://www.debian.org/security/2014/dsa-3050	vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/61854	third-party-advisoryx_refsource_SECUNIA

Date Public

2014-10-14 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T09:42:36.508Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "openSUSE-SU-2014:1344",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
          },
          {
            "name": "FEDORA-2014-13042",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
          },
          {
            "name": "1031028",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031028"
          },
          {
            "name": "openSUSE-SU-2014:1345",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-82.html"
          },
          {
            "name": "70424",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/70424"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
          },
          {
            "name": "GLSA-201504-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201504-01"
          },
          {
            "name": "RHSA-2014:1635",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
          },
          {
            "name": "FEDORA-2014-14084",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
          },
          {
            "name": "USN-2372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-2372-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
          },
          {
            "name": "62022",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62022"
          },
          {
            "name": "1031030",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031030"
          },
          {
            "name": "62023",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/62023"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1015540"
          },
          {
            "name": "DSA-3050",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2014/dsa-3050"
          },
          {
            "name": "61854",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/61854"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-20T16:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "openSUSE-SU-2014:1344",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
        },
        {
          "name": "FEDORA-2014-13042",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
        },
        {
          "name": "1031028",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031028"
        },
        {
          "name": "openSUSE-SU-2014:1345",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-82.html"
        },
        {
          "name": "70424",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/70424"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
        },
        {
          "name": "GLSA-201504-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201504-01"
        },
        {
          "name": "RHSA-2014:1635",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
        },
        {
          "name": "FEDORA-2014-14084",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
        },
        {
          "name": "USN-2372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-2372-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
        },
        {
          "name": "62022",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62022"
        },
        {
          "name": "1031030",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031030"
        },
        {
          "name": "62023",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/62023"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1015540"
        },
        {
          "name": "DSA-3050",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2014/dsa-3050"
        },
        {
          "name": "61854",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/61854"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2014-1583",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x before 31.2 does not properly restrict toJSON calls, which allows remote attackers to bypass the Same Origin Policy via crafted API calls that access sensitive information within the JSON data of an alarm."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "openSUSE-SU-2014:1344",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"
            },
            {
              "name": "FEDORA-2014-13042",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"
            },
            {
              "name": "1031028",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031028"
            },
            {
              "name": "openSUSE-SU-2014:1345",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2014/mfsa2014-82.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-82.html"
            },
            {
              "name": "70424",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/70424"
            },
            {
              "name": "https://advisories.mageia.org/MGASA-2014-0421.html",
              "refsource": "CONFIRM",
              "url": "https://advisories.mageia.org/MGASA-2014-0421.html"
            },
            {
              "name": "GLSA-201504-01",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201504-01"
            },
            {
              "name": "RHSA-2014:1635",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2014-1635.html"
            },
            {
              "name": "FEDORA-2014-14084",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"
            },
            {
              "name": "USN-2372-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-2372-1"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"
            },
            {
              "name": "62022",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62022"
            },
            {
              "name": "1031030",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031030"
            },
            {
              "name": "62023",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/62023"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1015540",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1015540"
            },
            {
              "name": "DSA-3050",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2014/dsa-3050"
            },
            {
              "name": "61854",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/61854"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2014-1583",
    "datePublished": "2014-10-15T10:00:00.000Z",
    "dateReserved": "2014-01-16T00:00:00.000Z",
    "dateUpdated": "2024-08-06T09:42:36.508Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2014:1635

CVE-2014-1574 (GCVE-0-2014-1574)

CVE-2014-1576 (GCVE-0-2014-1576)

CVE-2014-1577 (GCVE-0-2014-1577)

CVE-2014-1578 (GCVE-0-2014-1578)

CVE-2014-1581 (GCVE-0-2014-1581)

CVE-2014-1583 (GCVE-0-2014-1583)

Tags

Sightings

Nomenclature

Related by attack behaviour