PT-2014-1479 · Mozilla+3 · Thunderbird+5

Publicado 2014-09-02 · Atualizado 2024-12-12 · CVE-2014-1563

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 32.0 Firefox ESR versions prior to 31.1 Thunderbird versions prior to 31.1

Description The issue is related to a use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service, specifically heap memory corruption, via an SVG animation that interacts with the DOM and triggers incorrect cycle collection.

Recommendations For Mozilla Firefox versions prior to 32.0, update to version 32.0 or later. For Firefox ESR versions prior to 31.1, update to version 31.1 or later. For Thunderbird versions prior to 31.1, update to version 31.1 or later.

Exploit

Correção

DoS

RCE

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

ALT-PU-2014-2225

ALT-PU-2014-2226

BDU:2015-00444

BDU:2015-00471

BDU:2015-00707

CVE-2014-1563

MGASA-2014-0419

OPENSUSE-SU-2014_1098-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10230-1

OPENSUSE-SU-2024:14572-1

USN-2329-1

USN-2330-1

Produtos afetados

Alt Linux

Firefox Esr

Firefox

Suse

Thunderbird

Ubuntu

Referências · 3169

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://suse.com/security/cve/CVE-2011-2365 · Nota