Published: 03/09/2014 Updated: 30/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 435

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Mozilla Firefox prior to 32.0, Firefox ESR 31.x prior to 31.1, and Thunderbird 31.x prior to 31.1 do not properly initialize memory for GIF rendering, which allows remote malicious users to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.

Vulnerable Product	Search on Vulmon	Subscribe to Product
opensuse opensuse 12.3
opensuse opensuse 13.1
opensuse evergreen 11.4
mozilla thunderbird 31.0
mozilla firefox
mozilla firefox 31.0
mozilla firefox esr 31.0
mozilla firefox 30.0

Several security issues were fixed in Thunderbird ...

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Mozilla Foundation Security Advisory 2014-69 Uninitialized memory use during GIF rendering Announced September 2, 2014 Reporter Michal Zalewski Impact High Products Firefox, Firefox ESR, SeaMonkey, Thunderbird Fixed in ...

Mozilla Firefox before 320, Firefox ESR 31x before 311, and Thunderbird 31x before 311 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image ...

source: wwwsecurityfocuscom/bid/69525/info Mozilla Firefox and Thunderbird are prone to an information-disclosure vulnerability Attackers can exploit this issue to disclose sensitive information that may aid in further attacks This issue is fixed in: Firefox 32 Firefox ESR 311 Thunderbird 311 <style> body { background-col ...

CWE-824 https://bugzilla.mozilla.org/show_bug.cgi?id=1045977 http://www.mozilla.org/security/announce/2014/mfsa2014-69.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.html http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.html http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://security.gentoo.org/glsa/201504-01 http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html http://www.securitytracker.com/id/1030794 http://www.securitytracker.com/id/1030793 http://www.securityfocus.com/bid/69525 http://secunia.com/advisories/61114 http://secunia.com/advisories/60148 http://seclists.org/fulldisclosure/2014/Sep/18 http://packetstormsecurity.com/files/128132/Mozilla-Firefox-Secret-Leak.html http://www.securityfocus.com/archive/1/533357/100/0/threaded https://nvd.nist.gov https://usn.ubuntu.com/2330-1/https://www.exploit-db.com/exploits/39295/https://access.redhat.com/security/cve/cve-2014-1564

CVE-2014-1564

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect