Vulnerability Details : CVE-2014-1556
Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library.
Vulnerability category: Execute code
Products affected by CVE-2014-1556
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:24.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:24.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:24.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:24.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:24.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:24.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:24.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:24.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:24.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:24.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:24.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:24.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:24.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:24.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:24.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:24.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:24.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:24.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-1556
0.52%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 64 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-1556
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2014-1556
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-1556
-
http://www.debian.org/security/2014/dsa-2986
Debian -- Security Information -- DSA-2986-1 iceweasel
-
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Oracle Solaris Bulletin - April 2016
-
http://www.debian.org/security/2014/dsa-2996
Debian -- Security Information -- DSA-2996-1 icedove
-
http://secunia.com/advisories/59591
Sign in
-
http://secunia.com/advisories/59760
-
http://www.securitytracker.com/id/1030619
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Deny Service, and Spoof User Interface Elements - SecurityTracker
-
http://linux.oracle.com/errata/ELSA-2014-0918.html
linux.oracle.com | ELSA-2014-0918
-
http://secunia.com/advisories/60306
Sign in
-
https://security.gentoo.org/glsa/201504-01
Mozilla Products: Multiple vulnerabilities (GLSA 201504-01) — Gentoo security
-
http://secunia.com/advisories/59719
Sign in
-
http://www.securityfocus.com/bid/68822
Mozilla Firefox/Thunderbird CVE-2014-1556 Remote Code Execution Vulnerability
-
http://secunia.com/advisories/60486
Sign in
-
http://www.mozilla.org/security/announce/2014/mfsa2014-62.html
Exploitable WebGL crash with Cesium JavaScript library — MozillaVendor Advisory
-
http://www.securitytracker.com/id/1030620
Mozilla Thunderbird Multiple Flaws Let Remote Users Deny Service and Execute Arbitrary Code - SecurityTracker
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1028891
1028891 - (CVE-2014-1556) WebGL app crashes Firefox
-
http://secunia.com/advisories/60628
Sign in
-
http://secunia.com/advisories/60621
Sign in
-
http://secunia.com/advisories/60083
Sign in
Jump to