Published: 30/04/2014 Updated: 14/08/2020

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 828

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox prior to 29.0 and SeaMonkey prior to 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote malicious users to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox
mozilla seamonkey
canonical ubuntu linux 12.04
canonical ubuntu linux 12.10
canonical ubuntu linux 13.10
canonical ubuntu linux 14.04
opensuse opensuse 12.3
opensuse opensuse 13.1
fedoraproject fedora 19

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Mozilla Foundation Security Advisory 2014-39 Use-after-free in the Text Track Manager for HTML video Announced April 29, 2014 Reporter Abhishek Arya Impact Critical Products Firefox, SeaMonkey Fixed in ...

The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 290 and SeaMonkey before 226 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML d ...

CWE-787 CWE-416 https://bugzilla.mozilla.org/show_bug.cgi?id=989210 http://www.mozilla.org/security/announce/2014/mfsa2014-39.html http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00010.html http://lists.opensuse.org/opensuse-updates/2014-05/msg00033.html http://www.ubuntu.com/usn/USN-2185-1 http://secunia.com/advisories/59866 http://www.securitytracker.com/id/1030163 http://www.securitytracker.com/id/1030164 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://security.gentoo.org/glsa/201504-01 https://usn.ubuntu.com/2185-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-1525

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-1525

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect