CVE-2014-1565 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-125 — Out-of-bounds Read9 documents6 sources
Severity
5.0MEDIUMNVD
OSV10.0
EPSS
0.8%
top 25.98%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla Thunderbird
Timeline
PublishedSep 3
Latest updateMay 17

Description

The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 does not properly create audio timelines, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted API calls.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶Ubuntumozilla/firefox< 32.0+build1-0ubuntu0.14.04.1
▶NVDmozilla/firefox31.1.0+2
▶Ubuntumozilla/thunderbird< 1:31.1.1+build1-0ubuntu0.14.04.1

🔴Vulnerability Details

4
GHSA
GHSA-4444-m42x-r3q8: The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32↗2022-05-17
▶
OSV
thunderbird vulnerabilities↗2014-09-11
▶
OSV
firefox vulnerabilities↗2014-09-02
▶
OSV
CVE-2014-1565: The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32↗2014-09-02
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2014-09-11
▶
Red Hat
Mozilla: Out-of-bounds read in Web Audio audio timeline (MFSA 2014-70)↗2014-09-03
▶
Ubuntu
Firefox vulnerabilities↗2014-09-02
▶

💬Community

1
Bugzilla
CVE-2014-1565 Mozilla: Out-of-bounds read in Web Audio audio timeline (MFSA 2014-70)↗2014-09-01
▶