Unscored severity · published Apr 30, 2014
CVE-2014-1525
The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager…
–
CVSS
4.4%
EPSS
No
On KEV
Description
The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
Firefox · Mozilla
before 29.0 · source: NVD
FE
Fedora · Fedoraproject
19 · source: NVD
OP
Opensuse · Opensuse
12.3; 13.1 · source: NVD
SE
Seamonkey · Mozilla
before 2.26 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 12.10; 13.10; 14.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1525
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1525
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2014-05/msg00010.html
Mailing List
http://lists.opensuse.org/opensuse-updates/2014-05/msg00033.html
Third Party Advisory
http://secunia.com/advisories/59866
Vendor Advisory
http://www.mozilla.org/security/announce/2014/mfsa2014-39.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
More from Firefox
10.0
CVE-2019-11708
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
9.8
CVE-2024-9680
Mozilla Firefox Use-After-Free Vulnerability
9.8
CVE-2010-3765
Mozilla Multiple Products Remote Code Execution Vulnerability
9.6
CVE-2022-26486
Mozilla Firefox Use-After-Free Vulnerability
8.8
CVE-2023-5217
Google Chromium libvpx Heap Buffer Overflow Vulnerability