CVE-2014-8637

CWE-200 — Information ExposureCWE-125 — Out-of-bounds Read7 documents7 sources
Severity
5.0MEDIUM
EPSS
0.5%
top 34.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mozilla FirefoxMozilla Seamonkey
Timeline
PublishedJan 14
Latest updateMay 17

Description

Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers the rendering of malformed BMP data within a CANVAS element.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶NVDmozilla/firefox34.0.5
▶Ubuntufirefox< 35.0+build3-0ubuntu0.14.04.2

🔴Vulnerability Details

3
GHSA
GHSA-34f3-7q4m-qjx4: Mozilla Firefox before 35↗2022-05-17
▶
OSV
CVE-2014-8637: Mozilla Firefox before 35↗2015-01-14
▶
CVEList
CVE-2014-8637: Mozilla Firefox before 35↗2015-01-14
▶

📋Vendor Advisories

2
Red Hat
Mozilla: Uninitialized memory use during bitmap rendering (MFSA 2015-02)↗2015-01-15
▶
Ubuntu
Firefox vulnerabilities↗2015-01-14
▶

💬Community

1
Bugzilla
CVE-2014-8637 Mozilla: Uninitialized memory use during bitmap rendering (MFSA 2015-02)↗2015-01-12
▶