CVE-2014-8640
The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline operations, which allows remote attackers to cause a…
Does this matter?
Lower severity and a low EPSS score (2.39%). Track it; it rarely justifies an emergency change on its own.
Description
The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline operations, which allows remote attackers to cause a denial of service (uninitialized-memory read and application crash) via crafted API calls.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 2.39% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- mozilla/firefox · opensuse/opensuse · mozilla/seamonkey
- Source
- security@mozilla.org
References
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html
- http://secunia.com/advisories/62242
- http://secunia.com/advisories/62250
- http://secunia.com/advisories/62418
- http://secunia.com/advisories/62790
- http://www.mozilla.org/security/announce/2014/mfsa2015-05.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/72045
- http://www.securitytracker.com/id/1031533
- https://bugzilla.mozilla.org/show_bug.cgi?id=1100409
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99960
- https://security.gentoo.org/glsa/201504-01
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html
- http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html
- http://secunia.com/advisories/62242
- http://secunia.com/advisories/62250
- http://secunia.com/advisories/62418
- http://secunia.com/advisories/62790
- http://www.mozilla.org/security/announce/2014/mfsa2015-05.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/72045
- http://www.securitytracker.com/id/1031533
- https://bugzilla.mozilla.org/show_bug.cgi?id=1100409
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.