CVEvulnerability
CVE-2014-1557
9.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2014-07-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-94
Description
The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.
Affected configurations
• oracle solaris 11.3
• mozilla firefox (<= 30.0)
• mozilla firefox 24.0
• mozilla firefox 24.0.1
• mozilla firefox 24.0.2
• mozilla firefox 24.1.0
• mozilla firefox 24.1.1
• mozilla firefox esr 24.2
• mozilla firefox esr 24.3
• mozilla firefox esr 24.4
• mozilla firefox esr 24.5
• mozilla firefox esr 24.6
• mozilla thunderbird (<= 24.6)
• mozilla thunderbird 24.0
• mozilla thunderbird 24.0.1
• mozilla thunderbird 24.1
• mozilla thunderbird 24.1.1
• mozilla thunderbird 24.2
• mozilla thunderbird 24.3
• mozilla thunderbird 24.4
• mozilla thunderbird 24.5
• debian debian linux 6.0
• debian debian linux 7.0
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://linux.oracle.com/errata/ELSA-2014-0918.html linux.oracle.com
- http://secunia.com/advisories/59591 secunia.com
- http://secunia.com/advisories/59719 secunia.com
- http://secunia.com/advisories/59760 secunia.com
- http://secunia.com/advisories/60083 secunia.com
- http://secunia.com/advisories/60306 secunia.com
- http://secunia.com/advisories/60486 secunia.com
- http://secunia.com/advisories/60621 secunia.com
- http://secunia.com/advisories/60628 secunia.com
- http://www.debian.org/security/2014/dsa-2986 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2996 Third Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-64.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
- http://www.securityfocus.com/bid/68824 www.securityfocus.com
- http://www.securitytracker.com/id/1030619 www.securitytracker.com
- http://www.securitytracker.com/id/1030620 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=913805 Issue Tracking
- https://security.gentoo.org/glsa/201504-01 security.gentoo.org
- http://linux.oracle.com/errata/ELSA-2014-0918.html linux.oracle.com
- http://secunia.com/advisories/59591 secunia.com
- http://secunia.com/advisories/59719 secunia.com
- http://secunia.com/advisories/59760 secunia.com
- http://secunia.com/advisories/60083 secunia.com
- http://secunia.com/advisories/60306 secunia.com
- http://secunia.com/advisories/60486 secunia.com
- http://secunia.com/advisories/60621 secunia.com
- http://secunia.com/advisories/60628 secunia.com
- http://www.debian.org/security/2014/dsa-2986 Third Party Advisory
- http://www.debian.org/security/2014/dsa-2996 Third Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-64.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
- http://www.securityfocus.com/bid/68824 www.securityfocus.com
- http://www.securitytracker.com/id/1030619 www.securitytracker.com
- http://www.securitytracker.com/id/1030620 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=913805 Issue Tracking
- https://security.gentoo.org/glsa/201504-01 security.gentoo.org