CVE-2014-1550 Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap...
HighCVSS 10.0
EPSS 4.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | <= 30.0 | No fix listed |
| mozilla Thunderbird | <= 24.7 | No fix listed |
| mozilla Thunderbird | = 24.0 | No fix listed |
| mozilla Thunderbird | = 24.0.1 | No fix listed |
| mozilla Thunderbird | = 24.1 | No fix listed |
| mozilla Thunderbird | = 24.1.1 | No fix listed |
| mozilla Thunderbird | = 24.2 | No fix listed |
| mozilla Thunderbird | = 24.3 | No fix listed |
| mozilla Thunderbird | = 24.4 | No fix listed |
| mozilla Thunderbird | = 24.5 | No fix listed |
| mozilla Thunderbird | = 24.6 | No fix listed |
References
- 59760 third-party-advisory
- 60628 third-party-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- 1030619 vdb-entry
- 1030620 vdb-entry
- bugzilla.mozilla.org
- GLSA-201504-01 vendor-advisory