CVE-2014-8637: mozilla firefox

CVSS: 5.0v2.0MediumModified

AliasesUBUNTU-CVE-2014-8637

Published 14-01-2015Last modified 06-08-2024

Vulnerability summary

CVE-2014-8637 is a medium (CVSS 5.0) vulnerability in mozilla firefox. EPSS estimates a 2.17% chance of exploitation in the next 30 days, higher than 82% of scored vulnerabilities.

Overall risk

20/100

0100

Low · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

2.17%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 3

MGASA-2015-0028 OPENSUSE-SU-2024:10071-1 OPENSUSE-SU-2024:14572-1 USN-2458-1

Timeline

14-01-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize memory for BMP images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers the rendering of malformed BMP data within a CANVAS element.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

2.17%

Chance of exploitation in the next 30 days

Percentile

82%

Versus all other CVEs

30-day change

0.00 pp

From 2.17% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected systems

Mozilla2 products

firefox≤ 34.0.5
seamonkey≤ 2.31

Ubuntu1 product

firefox< 35.0+build3-0ubuntu0.14.04.2

2 vendors · 3 products

References

23 links

secunia.com/advisories/62242Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id/1031533VDB EntryX Refsource SECTRACK
lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/62250Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.htmlVendor AdvisoryX Refsource SUSE
bugzilla.mozilla.org/show_bug.cgi?id=1094536X Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/62418Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/62316Third Party AdvisoryX Refsource SECUNIA

Show all 23 references

security.gentoo.org/glsa/201504-01Vendor AdvisoryX Refsource GENTOO
www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlX Refsource CONFIRM
secunia.com/advisories/62790Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/99957VDB EntryX Refsource XF
secunia.com/advisories/62446Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.htmlVendor AdvisoryX Refsource SUSE
www.securityfocus.com/bid/72048VDB EntryX Refsource BID
secunia.com/advisories/62253Third Party AdvisoryX Refsource SECUNIA
www.mozilla.org/security/announce/2014/mfsa2015-02.htmlX Refsource CONFIRMVendor Advisory
ubuntu.com/security/CVE-2014-8637REPORT
www.mozilla.org/en-GB/security/advisories/mfsa2015-02/REPORT
ubuntu.com/security/notices/USN-2458-1Advisory
www.cve.org/CVERecord?id=CVE-2014-8637REPORT

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities