CVE-2014-1522 The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or....
HighCVSS 9.3
EPSS 5.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fedoraproject fedora | = 19 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.10 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| mozilla Firefox | < 29.0 | 29.0 |
| mozilla seamonkey | < 2.26 | 2.26 |
References
- FEDORA-2014-5829 third-party-advisory vendor-advisory
- openSUSE-SU-2014:0599 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0629 mailing-list third-party-advisory vendor-advisory
- 59866 third-party-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com third-party-advisory
- 1030163 third-party-advisory vdb-entry
- 1030164 third-party-advisory vdb-entry
- USN-2185-1 third-party-advisory vendor-advisory
- bugzilla.mozilla.org exploit issue-tracking patch vendor-advisory
- GLSA-201504-01 third-party-advisory vendor-advisory