PT-2014-1160 · Mozilla+4 · Seamonkey+7

Published 2014-03-18 · Updated 2024-12-12 · CVE-2014-1509

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 28.0 Mozilla Firefox ESR versions prior to 24.4 Mozilla Thunderbird versions prior to 24.4 Mozilla SeaMonkey versions prior to 2.25

Description The issue is related to a buffer overflow in the cairo truetype index to ucs4 function in the cairo class. This allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document. The vulnerability can be exploited by specially formed extensions, handling fonts in PDF documents, allowing remote attackers to execute arbitrary code.

Recommendations For Mozilla Firefox versions prior to 28.0, update to version 28.0 or later. For Mozilla Firefox ESR versions prior to 24.4, update to version 24.4 or later. For Mozilla Thunderbird versions prior to 24.4, update to version 24.4 or later. For Mozilla SeaMonkey versions prior to 2.25, update to version 2.25 or later. As a temporary workaround, consider disabling the handling of fonts in PDF documents until a patch is available. Restrict access to the vulnerable cairo truetype index to ucs4 function in the cairo class to minimize the risk of exploitation. Avoid using specially crafted extensions that render fonts in PDF documents until the issue is resolved.

Exploit

Fix

RCE

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

CWE-120

Related Identifiers

ALT-PU-2014-1407

ALT-PU-2014-1408

ALT-PU-2014-1411

BDU:2014-00280

BDU:2014-00281

BDU:2014-00282

BDU:2014-00283

CESA-2014_0310

CESA-2014_0316

CVE-2014-1509

DSA-2881-1

DSA-2911-1

MGASA-2014-0137

MGASA-2014-0146

OPENSUSE-SU-2014_0419-1

OPENSUSE-SU-2014_0448-1

OPENSUSE-SU-2014_0584-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10230-1

OPENSUSE-SU-2024:14572-1

RHSA-2014:0310

RHSA-2014:0316

RHSA-2014_0310

RHSA-2014_0316

Affected Products

Alt Linux

Centos

Firefox

Firefox Esr

Seamonkey

Thunderbird

Red Hat

Suse

References · 3177

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=966021 · Exploit