CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
AI Score
Confidence
Low
EPSS
Percentile
95.5%
Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.
Vendor | Product | Version | CPE |
---|---|---|---|
mozilla | firefox | * | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
mozilla | firefox | 30.0 | cpe:2.3:a:mozilla:firefox:30.0:*:*:*:*:*:*:* |
mozilla | firefox | 31.0 | cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:* |
mozilla | firefox_esr | 24.0 | cpe:2.3:a:mozilla:firefox_esr:24.0:*:*:*:*:*:*:* |
mozilla | firefox_esr | 24.0.1 | cpe:2.3:a:mozilla:firefox_esr:24.0.1:*:*:*:*:*:*:* |
mozilla | firefox_esr | 24.0.2 | cpe:2.3:a:mozilla:firefox_esr:24.0.2:*:*:*:*:*:*:* |
mozilla | firefox_esr | 24.1.0 | cpe:2.3:a:mozilla:firefox_esr:24.1.0:*:*:*:*:*:*:* |
mozilla | firefox_esr | 24.1.1 | cpe:2.3:a:mozilla:firefox_esr:24.1.1:*:*:*:*:*:*:* |
mozilla | firefox_esr | 24.2 | cpe:2.3:a:mozilla:firefox_esr:24.2:*:*:*:*:*:*:* |
mozilla | firefox_esr | 24.3 | cpe:2.3:a:mozilla:firefox_esr:24.3:*:*:*:*:*:*:* |
lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.html
lists.opensuse.org/opensuse-security-announce/2014-09/msg00005.html
lists.opensuse.org/opensuse-security-announce/2014-09/msg00007.html
lists.opensuse.org/opensuse-security-announce/2014-09/msg00012.html
lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
lists.opensuse.org/opensuse-updates/2014-09/msg00011.html
secunia.com/advisories/60148
secunia.com/advisories/60186
secunia.com/advisories/61114
secunia.com/advisories/61390
www.debian.org/security/2014/dsa-3018
www.debian.org/security/2014/dsa-3028
www.mozilla.org/security/announce/2014/mfsa2014-72.html
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
www.securityfocus.com/bid/69520
www.securitytracker.com/id/1030793
www.securitytracker.com/id/1030794
bugzilla.mozilla.org/show_bug.cgi?id=1037641
security.gentoo.org/glsa/201504-01