10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.9 High
AI Score
Confidence
High
0.021 Low
EPSS
Percentile
89.2%
Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij,
Jesse Ruderman, Nathan Froyd, John Schoenick, Karl Tomlinson, Vladimir
Vukicevic and Christian Holler discovered multiple memory safety issues in
Firefox. If a user were tricked in to opening a specially crafted website,
an attacker could potentially exploit these to cause a denial of service
via application crash, or execute arbitrary code with the privileges of
the user invoking Firefox. (CVE-2014-1518, CVE-2014-1519)
An out of bounds read was discovered in Web Audio. An attacker could
potentially exploit this cause a denial of service via application crash
or execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2014-1522)
Abhishek Arya discovered an out of bounds read when decoding JPG images.
An attacker could potentially exploit this to cause a denial of service
via application crash. (CVE-2014-1523)
Abhishek Arya discovered a buffer overflow when a script uses a non-XBL
object as an XBL object. An attacker could potentially exploit this to
execute arbitrary code with the privileges of the user invoking Firefox.
(CVE-2014-1524)
Abhishek Arya discovered a use-after-free in the Text Track Manager when
processing HTML video. An attacker could potentially exploit this to cause
a denial of service via application crash or execute arbitrary code with
the privileges of the user invoking Firefox. (CVE-2014-1525)
Jukka Jylänki discovered an out-of-bounds write in Cairo when working
with canvas in some circumstances. An attacker could potentially exploit
this to cause a denial of service via application crash or execute
arbitrary code with the privileges of the user invoking Firefox.
(CVE-2014-1528)
Mariusz Mlynski discovered that sites with notification permissions can
run script in a privileged context in some circumstances. An attacker
could exploit this to execute arbitrary code with the privileges of the
user invoking Firefox. (CVE-2014-1529)
It was discovered that browser history navigations could be used to load
a site with the addressbar displaying the wrong address. An attacker could
potentially exploit this to conduct cross-site scripting or phishing
attacks. (CVE-2014-1530)
A use-after-free was discovered when resizing images in some
circumstances. An attacker could potentially exploit this to cause a
denial of service via application crash or execute arbitrary code with the
privileges of the user invoking Firefox. (CVE-2014-1531)
Christian Heimes discovered that NSS did not handle IDNA domain prefixes
correctly for wildcard certificates. An attacker could potentially exploit
this by using a specially crafted certificate to conduct a machine-in-the-middle
attack. (CVE-2014-1492)
Tyson Smith and Jesse Schwartzentruber discovered a use-after-free during
host resolution in some circumstances. An attacker could potentially
exploit this to cause a denial of service via application crash or execute
arbitrary code with the privileges of the user invoking Firefox.
(CVE-2014-1532)
Boris Zbarsky discovered that the debugger bypassed XrayWrappers for some
objects. If a user were tricked in to opening a specially crafted website
whilst using the debugger, an attacker could potentially exploit this to
execute arbitrary code with the privileges of the user invoking Firefox.
(CVE-2014-1526)
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Ubuntu | 14.04 | noarch | firefox | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
Ubuntu | 14.04 | noarch | firefox-dbg | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
Ubuntu | 14.04 | noarch | firefox-dev | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
Ubuntu | 14.04 | noarch | firefox-globalmenu | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
Ubuntu | 14.04 | noarch | firefox-locale-af | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
Ubuntu | 14.04 | noarch | firefox-locale-an | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
Ubuntu | 14.04 | noarch | firefox-locale-ar | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
Ubuntu | 14.04 | noarch | firefox-locale-as | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
Ubuntu | 14.04 | noarch | firefox-locale-ast | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
Ubuntu | 14.04 | noarch | firefox-locale-be | < 29.0+build1-0ubuntu0.14.04.2 | UNKNOWN |
launchpad.net/bugs/1313464
ubuntu.com/security/CVE-2014-1492
ubuntu.com/security/CVE-2014-1518
ubuntu.com/security/CVE-2014-1519
ubuntu.com/security/CVE-2014-1522
ubuntu.com/security/CVE-2014-1523
ubuntu.com/security/CVE-2014-1524
ubuntu.com/security/CVE-2014-1525
ubuntu.com/security/CVE-2014-1526
ubuntu.com/security/CVE-2014-1528
ubuntu.com/security/CVE-2014-1529
ubuntu.com/security/CVE-2014-1530
ubuntu.com/security/CVE-2014-1531
ubuntu.com/security/CVE-2014-1532
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.9 High
AI Score
Confidence
High
0.021 Low
EPSS
Percentile
89.2%