CVE-2014-1509 Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows...
HighCVSS 8.8
EPSS 5.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | < 28.0 | 28.0 |
| mozilla Firefox | >= 24.0, < 24.4 | 24.4 |
| mozilla seamonkey | < 2.25 | 2.25 |
| mozilla Thunderbird | < 24.4 | 24.4 |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux eus | = 6.5 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server aus | = 6.5 | No fix listed |
| redhat enterprise linux server eus | = 6.5 | No fix listed |
| redhat enterprise linux server tus | = 6.5 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.10 | No fix listed |
| suse linux enterprise software development kit | = 11.0-sp3 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| suse linux enterprise desktop | = 11-sp3 | No fix listed |
| suse linux enterprise server | = 11-sp3 | No fix listed |
References
- SUSE-SU-2014:0418 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0419 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0448 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0584 mailing-list third-party-advisory vendor-advisory
- RHSA-2014:0310 third-party-advisory vendor-advisory
- RHSA-2014:0316 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com third-party-advisory
- 66425 third-party-advisory vdb-entry
- USN-2151-1 third-party-advisory vendor-advisory
- bugzilla.mozilla.org exploit issue-tracking vendor-advisory
- GLSA-201504-01 third-party-advisory vendor-advisory