CVE-2014-1576
Mozilla: Buffer overflow during CSS manipulation (MFSA 2014-75)
Severity Score
7.5
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Heap-based buffer overflow in the nsTransformedTextRun function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to execute arbitrary code via Cascading Style Sheets (CSS) token sequences that trigger changes to capitalization style.
Desbordamiento de buffer basado en memoria dinámica en la función nsTransformedTextRun en Mozilla Firefox anterior a 33.0, Firefox ESR 31.x anterior a 31.2, y Thunderbird 31.x anterior a 31.2 permite a atacantes remotos ejecutar código arbitrario a través de secuencias de tokens Cascading Style Sheets (CSS) que provocan cambios en el estilo de capitalización.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2014-01-16 CVE Reserved
- 2014-10-14 CVE Published
- 2024-04-10 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (28)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/61387 | Third Party Advisory | |
| http://secunia.com/advisories/61854 | Third Party Advisory | |
| http://secunia.com/advisories/62021 | Third Party Advisory | |
| http://secunia.com/advisories/62022 | Third Party Advisory | |
| http://secunia.com/advisories/62023 | Third Party Advisory | |
| http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html | X_refsource_confirm |
|
| http://www.securityfocus.com/bid/70430 | Vdb Entry | |
| http://www.securitytracker.com/id/1031028 | Vdb Entry | |
| http://www.securitytracker.com/id/1031030 | Vdb Entry | |
| https://advisories.mageia.org/MGASA-2014-0421.html | X_refsource_confirm | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1041512 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | 31.0 Search vendor "Mozilla" for product "Thunderbird" and version "31.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | 31.1.0 Search vendor "Mozilla" for product "Thunderbird" and version "31.1.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.0 Search vendor "Mozilla" for product "Firefox Esr" and version "31.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.1.0 Search vendor "Mozilla" for product "Firefox Esr" and version "31.1.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | <= 32.0 Search vendor "Mozilla" for product "Firefox" and version " <= 32.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 30.0 Search vendor "Mozilla" for product "Firefox" and version "30.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 31.0 Search vendor "Mozilla" for product "Firefox" and version "31.0" | - |
Affected
| ||||||
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | 31.1.0 Search vendor "Mozilla" for product "Firefox" and version "31.1.0" | - |
Affected
| ||||||