CVE-2014-8640 : The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefo

The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline operations, which allows remote attackers to cause a denial of service (uninitialized-memory read and application crash) via crafted API calls.

Published 2015-01-14 11:59:09

Updated 2018-10-30 16:27:36

Source Mozilla Corporation

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2014-8640

EPSS FAQ

4.80%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 93 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-8640

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2014-8640

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-8640

http://www.securityfocus.com/bid/72045

Mozilla Firefox/SeaMonkey Web Audio Denial of Service Vulnerability
https://bugzilla.mozilla.org/show_bug.cgi?id=1100409

1100409 - (CVE-2014-8640) Crash in mozilla::dom::AudioParamTimeline::AudioNodeInputValue
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.html

[security-announce] SUSE-SU-2015:0171-1: important: Security update for

CVEs referencing this url
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Oracle Solaris Bulletin - April 2016

CVEs referencing this url
http://www.securitytracker.com/id/1031533

Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Request Forgery Attacks, and Obtain Potentially Sensitive Information - SecurityTracker

CVEs referencing this url
http://www.mozilla.org/security/announce/2014/mfsa2015-05.html

Read of uninitialized memory in Web Audio — Mozilla
Vendor Advisory
https://security.gentoo.org/glsa/201504-01

Mozilla Products: Multiple vulnerabilities (GLSA 201504-01) — Gentoo security

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/99960

Mozilla Firefox and SeaMonkey Web Audio information disclosure CVE-2014-8640 Vulnerability Report
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.html

[security-announce] SUSE-SU-2015:0173-1: important: Security update for

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html

[security-announce] openSUSE-SU-2015:0192-1: important: Security update

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html

[security-announce] openSUSE-SU-2015:0077-1: important: Security update

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.html

[security-announce] SUSE-SU-2015:0180-1: important: Security update for

CVEs referencing this url
http://secunia.com/advisories/62418

Sign in

CVEs referencing this url

Products affected by CVE-2014-8640

Mozilla » Firefox
Versions up to, including, (<=) 34.0.5
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Matching versions
Mozilla » Seamonkey
Versions up to, including, (<=) 2.31
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
Matching versions
Opensuse » Opensuse » Version: 13.2
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
Matching versions
Opensuse » Opensuse » Version: 13.1
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Matching versions

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!

Accept Close

Vulnerability Details : CVE-2014-8640

Exploit prediction scoring system (EPSS) score for CVE-2014-8640

CVSS scores for CVE-2014-8640

CWE ids for CVE-2014-8640

References for CVE-2014-8640

Products affected by CVE-2014-8640