CVE-2014-8640 The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline oper...
MediumCVSS 5.0
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly restrict timeline operations, which allows remote attackers to cause a denial of service (uninitialized-memory read and application crash) via crafted API calls.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | <= 34.0.5 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| mozilla seamonkey | <= 2.31 | No fix listed |
References
- openSUSE-SU-2015:0077 vendor-advisory
- SUSE-SU-2015:0171 vendor-advisory
- SUSE-SU-2015:0173 vendor-advisory
- SUSE-SU-2015:0180 vendor-advisory
- openSUSE-SU-2015:0192 vendor-advisory
- 62242 third-party-advisory
- 62250 third-party-advisory
- 62418 third-party-advisory
- 62790 third-party-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- 72045 vdb-entry
- 1031533 vdb-entry
- bugzilla.mozilla.org
- firefox-cve20148640-info-disc(99960) vdb-entry
- GLSA-201504-01 vendor-advisory