CVE-2014-1540 : Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerI

Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.

Published 2014-06-11 10:57:18

Updated 2017-12-28 02:29:01

Source Mozilla Corporation

View at NVD, CVE.org

Vulnerability category: Memory CorruptionExecute codeDenial of service

Products affected by CVE-2014-1540

Mozilla » Firefox
Versions up to, including, (<=) 29.0.1
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-1540

EPSS FAQ

2.36%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 89 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-1540

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2014-1540

http://secunia.com/advisories/59486

Sign in

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2243-1

USN-2243-1: Firefox vulnerabilities | Ubuntu security notices

CVEs referencing this url
http://lists.opensuse.org/opensuse-updates/2014-07/msg00001.html

openSUSE-SU-2014:0855-1: moderate: seamonkey: Update fixes nine security

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Oracle Solaris Bulletin - April 2016

CVEs referencing this url
http://www.mozilla.org/security/announce/2014/mfsa2014-51.html

Use-after-free in Event Listener Manager — Mozilla
Vendor Advisory
https://security.gentoo.org/glsa/201504-01

Mozilla Products: Multiple vulnerabilities (GLSA 201504-01) — Gentoo security

CVEs referencing this url
https://bugzilla.mozilla.org/show_bug.cgi?id=978862

978862 - (CVE-2014-1540) heap-use-after-free in nsEventListenerManager::CompileEventHandlerInternal
http://www.securitytracker.com/id/1030388

Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code and Conduct Clickjacking Attacks - SecurityTracker

CVEs referencing this url
http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html

openSUSE-SU-2014:0819-1: moderate: MozillaFirefox, mozilla-nspr: Update

CVEs referencing this url
http://www.securityfocus.com/bid/67978

Mozilla Firefox CVE-2014-1540 Memory Corruption Vulnerability

Jump to

Vulnerability Details : CVE-2014-1540

Products affected by CVE-2014-1540

Exploit prediction scoring system (EPSS) score for CVE-2014-1540

CVSS scores for CVE-2014-1540

References for CVE-2014-1540