Vulnerability Details : CVE-2014-8643
Mozilla Firefox before 35.0 on Windows allows remote attackers to bypass the Gecko Media Plugin (GMP) sandbox protection mechanism by leveraging access to the GMP process, as demonstrated by the OpenH264 plugin's process.
Products affected by CVE-2014-8643
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-8643
1.30%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 78 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-8643
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.1
|
HIGH | AV:N/AC:M/Au:N/C:N/I:C/A:N |
8.6
|
6.9
|
NIST |
CWE ids for CVE-2014-8643
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-8643
-
http://secunia.com/advisories/62253
Sign in
-
http://www.securityfocus.com/bid/72043
Mozilla Firefox Gecko Media Plugin Sandbox Security Bypass Vulnerability
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1117140
1117140 - (CVE-2014-8643) GMP sandbox break-out on Windows through process handle
-
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Oracle Solaris Bulletin - April 2016
-
http://www.securitytracker.com/id/1031533
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code, Conduct Cross-Site Request Forgery Attacks, and Obtain Potentially Sensitive Information - SecurityTracker
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/99962
Mozilla Firefox Gecko Media Plugin security bypass CVE-2014-8643 Vulnerability Report
-
http://secunia.com/advisories/62446
Sign in
-
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.html
[security-announce] openSUSE-SU-2015:0192-1: important: Security update
-
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.html
[security-announce] openSUSE-SU-2015:0077-1: important: Security update
-
http://www.mozilla.org/security/announce/2014/mfsa2015-07.html
Gecko Media Plugin sandbox escape — MozillaVendor Advisory
Jump to