CVE-2014-1542: mozilla firefox

CVSS: 6.8v2.0MediumModified

AliasesUBUNTU-CVE-2014-1542

Published 11-06-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-1542 is a medium (CVSS 6.8) vulnerability in mozilla firefox. EPSS estimates a 5.30% chance of exploitation in the next 30 days, higher than 92.4% of scored vulnerabilities.

Overall risk

28/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

5.30%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 3

MGASA-2014-0419 OPENSUSE-SU-2024:10071-1 OPENSUSE-SU-2024:14572-1 USN-2243-1

Timeline

11-06-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

5.30%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

0.00 pp

From 5.30% on 19-09-2026

19-09-202619-10-2026

EPSS score

5.30%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Mozilla1 product

firefox≤ 29.0.1

Opensuse1 product

opensuseEOL13.1

Opensuse_project1 product

opensuse12.3

Oracle1 product

solarisEOL11.3

Ubuntu1 product

firefox< 30.0+build1-0ubuntu0.14.04.3

5 vendors · 5 products

References

17 links

lists.opensuse.org/opensuse-updates/2014-06/msg00040.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/59387Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.securitytracker.com/id/1030388VDB EntryX Refsource SECTRACKThird Party Advisory
secunia.com/advisories/59052Third Party AdvisoryX Refsource SECUNIAPermissions Required
lists.opensuse.org/opensuse-updates/2014-07/msg00001.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
bugzilla.mozilla.org/show_bug.cgi?id=991533X Refsource CONFIRMIssue Tracking
security.gentoo.org/glsa/201504-01Vendor AdvisoryX Refsource GENTOO
secunia.com/advisories/59866Third Party AdvisoryX Refsource SECUNIAPermissions Required
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlX Refsource CONFIRMThird Party Advisory
www.mozilla.org/security/announce/2014/mfsa2014-53.htmlX Refsource CONFIRMVendor AdvisoryREPORT

Show all 17 references

www.securityfocus.com/bid/67968VDB EntryX Refsource BIDThird Party Advisory
www.ubuntu.com/usn/USN-2243-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/59171Third Party AdvisoryX Refsource SECUNIAPermissions Required
secunia.com/advisories/59486Third Party AdvisoryX Refsource SECUNIA
ubuntu.com/security/CVE-2014-1542REPORT
www.cve.org/CVERecord?id=CVE-2014-1542REPORT
ubuntu.com/security/notices/USN-2243-1Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities