PT-2014-1147 · Mozilla+4 · Seamonkey+7

Publicado 2014-03-18 · Atualizado 2024-12-12 · CVE-2014-1512

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 28.0 Mozilla Firefox ESR versions prior to 24.4 Mozilla Thunderbird versions prior to 24.4 Mozilla SeaMonkey versions prior to 2.25

Description The issue is related to a use-after-free vulnerability in the TypeObject class in the JavaScript engine, allowing remote attackers to execute arbitrary code by triggering extensive memory consumption during garbage collection. This can be achieved by improper handling of BumpChunk objects.

Recommendations For Mozilla Firefox versions prior to 28.0, update to version 28.0 or later. For Mozilla Firefox ESR versions prior to 24.4, update to version 24.4 or later. For Mozilla Thunderbird versions prior to 24.4, update to version 24.4 or later. For Mozilla SeaMonkey versions prior to 2.25, update to version 2.25 or later.

Exploit

Correção

RCE

Use After Free

Enumeração de Fraquezas

CWE-399

CWE-416

Identificadores relacionados

ALT-PU-2014-1407

ALT-PU-2014-1408

ALT-PU-2014-1411

BDU:2014-00247

BDU:2014-00248

BDU:2014-00249

BDU:2014-00250

CESA-2014_0310

CESA-2014_0316

CVE-2014-1512

DSA-2881-1

DSA-2911-1

MGASA-2014-0137

MGASA-2014-0146

OPENSUSE-SU-2014_0419-1

OPENSUSE-SU-2014_0448-1

OPENSUSE-SU-2014_0584-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10230-1

OPENSUSE-SU-2024:14572-1

RHSA-2014:0310

RHSA-2014:0316

RHSA-2014_0310

RHSA-2014_0316

ZDI-14-083

Produtos afetados

Alt Linux

Centos

Firefox

Firefox Esr

Seamonkey

Thunderbird

Red Hat

Suse

Referências · 3183

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=982957 · Exploit