CVE-2014-1564
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script…
Does this matter?
Lower severity and a low EPSS score (5.46%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
- EPSS
- 5.46% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-824
- Affected
- opensuse/evergreen · opensuse/opensuse · mozilla/firefox · mozilla/thunderbird
- Source
- security@mozilla.org
References
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.htmlThird Party Advisory
- http://packetstormsecurity.com/files/128132/Mozilla-Firefox-Secret-Leak.html
- http://seclists.org/fulldisclosure/2014/Sep/18
- http://secunia.com/advisories/60148
- http://secunia.com/advisories/61114
- http://www.mozilla.org/security/announce/2014/mfsa2014-69.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/archive/1/533357/100/0/threaded
- http://www.securityfocus.com/bid/69525
- http://www.securitytracker.com/id/1030793
- http://www.securitytracker.com/id/1030794
- https://bugzilla.mozilla.org/show_bug.cgi?id=1045977Issue Tracking
- https://security.gentoo.org/glsa/201504-01
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.htmlThird Party Advisory
- http://packetstormsecurity.com/files/128132/Mozilla-Firefox-Secret-Leak.html
- http://seclists.org/fulldisclosure/2014/Sep/18
- http://secunia.com/advisories/60148
- http://secunia.com/advisories/61114
- http://www.mozilla.org/security/announce/2014/mfsa2014-69.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/archive/1/533357/100/0/threaded
- http://www.securityfocus.com/bid/69525
- http://www.securitytracker.com/id/1030793
- http://www.securitytracker.com/id/1030794
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.