CVE-2014-1514 — Out-of-bounds Write in Mozilla Firefox

CWE-787 — Out-of-bounds Write8 documents6 sources
Severity
9.8CRITICALNVD
EPSS
4.2%
top 11.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
16
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird+13 more
Timeline
PublishedMar 19
Latest updateMay 13

Description

vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages10 packages

▶NVDmozilla/firefox24.0 — 24.4+1
▶NVDmozilla/seamonkey< 2.25
▶NVDopensuse/opensuse11.4, 12.3, 13.1+2

Also affects: Debian Linux 7.0, 8.0, Ubuntu Linux 12.04, 12.10, 13.10, Enterprise Linux 6.5

🔴Vulnerability Details

2
GHSA
GHSA-8jfj-fq3q-fgxw: vmtypedarrayobject↗2022-05-13
▶
CVEList
CVE-2014-1514: vmtypedarrayobject↗2014-03-19
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2014-03-21
▶
Red Hat
Mozilla: Out-of-bounds write through TypedArrayObject after neutering (MFSA 2014-32)↗2014-03-18
▶
Ubuntu
Firefox vulnerabilities↗2014-03-18
▶

💬Community

2
Bugzilla
CVE-2014-3649 JBoss AeroGear: reflected XSS via password field of the login page↗2014-09-19
▶
Bugzilla
CVE-2014-1514 Mozilla: Out-of-bounds write through TypedArrayObject after neutering (MFSA 2014-32)↗2014-03-18
▶
CVE-2014-1514 — Out-of-bounds Write in Mozilla Firefox | cvebase