PT-2014-1152 · Mozilla+4 · Seamonkey+7

Publicado 2014-02-04 · Atualizado 2024-12-12 · CVE-2014-1486

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 27.0 Mozilla Firefox ESR 24.x versions prior to 24.3 Mozilla Thunderbird versions prior to 24.3 Mozilla SeaMonkey versions prior to 2.24

Description The issue is related to a use-after-free error in the imgRequestProxy function, allowing remote attackers to execute arbitrary code through vectors involving unspecified Content-Type values for image data. This can be exploited by using values of Content-Type from image data, enabling remote attackers to execute arbitrary code.

Recommendations For Mozilla Firefox versions prior to 27.0, update to version 27.0 or later. For Mozilla Firefox ESR 24.x versions prior to 24.3, update to version 24.3 or later. For Mozilla Thunderbird versions prior to 24.3, update to version 24.3 or later. For Mozilla SeaMonkey versions prior to 2.24, update to version 2.24 or later. As a temporary workaround, consider disabling the imgRequestProxy function until a patch is available.

Exploit

Correção

RCE

Use After Free

Enumeração de Fraquezas

CWE-399

CWE-416

Identificadores relacionados

ALT-PU-2014-1211

ALT-PU-2014-1212

ALT-PU-2014-1266

BDU:2014-00265

BDU:2014-00266

BDU:2014-00267

BDU:2014-00268

CESA-2014_0132

CESA-2014_0133

CVE-2014-1486

DSA-2858-1

MGASA-2014-0036

MGASA-2014-0048

OPENSUSE-SU-2014_0213-1

OPENSUSE-SU-2014_0419-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10230-1

OPENSUSE-SU-2024:14572-1

RHSA-2014:0132

RHSA-2014:0133

RHSA-2014_0132

RHSA-2014_0133

ZDI-14-058

Produtos afetados

Alt Linux

Centos

Firefox

Firefox Esr

Seamonkey

Thunderbird

Red Hat

Suse

Referências · 3184

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://suse.com/security/cve/CVE-2009-0354 · Nota