CVE-2014-8637 Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted....
MediumCVSS 5.0
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers the rendering of malformed BMP data within a CANVAS element.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla seamonkey | <= 2.31 | No fix listed |
| mozilla Firefox | <= 34.0.5 | No fix listed |
References
- openSUSE-SU-2015:0077 vendor-advisory
- SUSE-SU-2015:0171 vendor-advisory
- SUSE-SU-2015:0173 vendor-advisory
- SUSE-SU-2015:0180 vendor-advisory
- openSUSE-SU-2015:0192 vendor-advisory
- 62242 third-party-advisory
- 62250 third-party-advisory
- 62253 third-party-advisory
- 62316 third-party-advisory
- 62418 third-party-advisory
- 62446 third-party-advisory
- 62790 third-party-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- 72048 vdb-entry
- 1031533 vdb-entry
- bugzilla.mozilla.org
- firefox-cve20148637-info-disc(99957) vdb-entry
- GLSA-201504-01 vendor-advisory