PT-2014-1777 · Mozilla+5 · Nspr+5

Published 2014-06-11 · Updated 2024-12-12 · CVE-2014-1545

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NSPR versions prior to 4.10.6

Description The issue affects the Mozilla Netscape Portable Runtime (NSPR) and can be exploited remotely, potentially leading to a violation of confidentiality, integrity, and availability of protected information. The exploitation involves vectors related to the sprintf and console functions, which can result in the execution of arbitrary code or a denial of service due to an out-of-bounds write.

Recommendations For NSPR versions prior to 4.10.6, update to version 4.10.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the sprintf and console functions until a patch is available.

Exploit

Fix

Related Identifiers

ALT-PU-2014-1976

BDU:2015-02539

CESA-2014_0917

CVE-2014-1545

DLA-32-1

DSA-2955-1

DSA-2960-1

DSA-2962-1

OPENSUSE-SU-2014_0797-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:10218-1

OPENSUSE-SU-2024:10230-1

OPENSUSE-SU-2024:10297-1

OPENSUSE-SU-2024:14572-1

RHSA-2014:0917

RHSA-2014:1246

RHSA-2014_0917

RHSA-2014_1246

USN-2265-1

Affected Products

Alt Linux

Centos

Nspr

Red Hat

Suse

Ubuntu

References · 3146

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://bdu.fstec.ru/vul/2015-00064 · Security Note