PT-2015-4071 · Mozilla+3 · Firefox+4

Holger Fuhrmannek

·

Publicado

2015-01-13

·

Atualizado

2024-12-12

·

CVE-2014-8640

CVSS v2.0

5.0

Média

VetorAV:N/AC:L/Au:N/C:N/I:N/A:P
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 35.0 SeaMonkey versions prior to 2.32
Description The issue concerns the Web Audio API implementation, specifically the mozilla::dom::AudioParamTimeline::AudioNodeInputValue function. This function does not properly restrict timeline operations, allowing remote attackers to cause a denial of service. The denial of service can be achieved through crafted API calls, resulting in an uninitialized-memory read and application crash.
Recommendations For Mozilla Firefox versions prior to 35.0, update to version 35.0 or later to resolve the issue. For SeaMonkey versions prior to 2.32, update to version 2.32 or later to resolve the issue.

Exploit

Correção

DoS

Race Condition

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

ALT-PU-2015-1082
ALT-PU-2015-1112
ALT-PU-2015-1464
CVE-2014-8640
MGASA-2015-0028
OPENSUSE-SU-2015_0077-1
OPENSUSE-SU-2015_0077-2
OPENSUSE-SU-2015_0192-1
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1
USN-2458-1
USN-2458-2
USN-2458-3

Produtos afetados

Alt Linux
Firefox
Seamonkey
Suse
Ubuntu