CVE-2014-1557

Mozilla: Crash in Skia library when scaling high quality images (MFSA 2014-64)

Severity Score

9.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.

La función ConvolveHorizontally en Skia, utilizado en Mozilla Firefox anterior a 31.0, Firefox ESR 24.x anterior a 24.7 y Thunderbird anterior a 24.7, no maneja debidamente el descarte de datos de imágenes durante la ejecución de la función, lo que permite a atacantes remotos ejecutar código arbitrario mediante la provocación del escalado prolongado de imágenes, tal y como fue demostrado mediante el escalado de un imagen de alta calidad.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-01-16 CVE Reserved
2014-07-22 CVE Published
2024-06-04 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-672: Operation on a Resource after Expiration or Release

CAPEC

References (20)

URL	Tag	Source
http://linux.oracle.com/errata/ELSA-2014-0918.html	X_refsource_confirm
http://secunia.com/advisories/59591	Third Party Advisory
http://secunia.com/advisories/59719	Third Party Advisory
http://secunia.com/advisories/59760	Third Party Advisory
http://secunia.com/advisories/60083	Third Party Advisory
http://secunia.com/advisories/60306	Third Party Advisory
http://secunia.com/advisories/60486	Third Party Advisory
http://secunia.com/advisories/60621	Third Party Advisory
http://secunia.com/advisories/60628	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
http://www.securityfocus.com/bid/68824	Vdb Entry
http://www.securitytracker.com/id/1030619	Vdb Entry
http://www.securitytracker.com/id/1030620	Vdb Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=913805	Issue Tracking

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www.debian.org/security/2014/dsa-2986	2017-01-07
http://www.debian.org/security/2014/dsa-2996	2017-01-07
http://www.mozilla.org/security/announce/2014/mfsa2014-64.html	2017-01-07
https://security.gentoo.org/glsa/201504-01	2017-01-07
https://access.redhat.com/security/cve/CVE-2014-1557	2014-07-22
https://bugzilla.redhat.com/show_bug.cgi?id=1121479	2014-07-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Oracle Search vendor "Oracle"		Solaris Search vendor "Oracle" for product "Solaris"				11.3 Search vendor "Oracle" for product "Solaris" and version "11.3"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				<= 30.0 Search vendor "Mozilla" for product "Firefox" and version " <= 30.0"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.0 Search vendor "Mozilla" for product "Firefox Esr" and version "24.0"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.0.1 Search vendor "Mozilla" for product "Firefox Esr" and version "24.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.0.2 Search vendor "Mozilla" for product "Firefox Esr" and version "24.0.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.1.0 Search vendor "Mozilla" for product "Firefox Esr" and version "24.1.0"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.1.1 Search vendor "Mozilla" for product "Firefox Esr" and version "24.1.1"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.2 Search vendor "Mozilla" for product "Firefox Esr" and version "24.2"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.3 Search vendor "Mozilla" for product "Firefox Esr" and version "24.3"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.4 Search vendor "Mozilla" for product "Firefox Esr" and version "24.4"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.5 Search vendor "Mozilla" for product "Firefox Esr" and version "24.5"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				24.6 Search vendor "Mozilla" for product "Firefox Esr" and version "24.6"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				<= 24.6 Search vendor "Mozilla" for product "Thunderbird" and version " <= 24.6"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				24.0 Search vendor "Mozilla" for product "Thunderbird" and version "24.0"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				24.0.1 Search vendor "Mozilla" for product "Thunderbird" and version "24.0.1"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				24.1 Search vendor "Mozilla" for product "Thunderbird" and version "24.1"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				24.1.1 Search vendor "Mozilla" for product "Thunderbird" and version "24.1.1"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				24.2 Search vendor "Mozilla" for product "Thunderbird" and version "24.2"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				24.3 Search vendor "Mozilla" for product "Thunderbird" and version "24.3"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				24.4 Search vendor "Mozilla" for product "Thunderbird" and version "24.4"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				24.5 Search vendor "Mozilla" for product "Thunderbird" and version "24.5"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				6.0 Search vendor "Debian" for product "Debian Linux" and version "6.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				7.0 Search vendor "Debian" for product "Debian Linux" and version "7.0"		-		Affected