MGASA-2014-0259: iceape Mageia
CVSS: UnknownPublished
Published 11-06-2014Last modified 16-04-2026
Vulnerability summary
MGASA-2014-0259 is a vulnerability in iceape Mageia with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 11 · Downstream 0Timeline
- 11-06-2014PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated iceape packages fix multiple vulnerabilities Updated iceape packages fix security issues: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1518) Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1519) The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content. (CVE-2014-1522) Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image. (CVE-2014-1523) The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object. (CVE-2014-1524) The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document. (CVE-2014-1525) The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted. (CVE-2014-1529) The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation. (CVE-2014-1530) Use-after-free vulnerability in the nsGenericHTMLElement:: GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation. (CVE-2014-1531) Use-after-free vulnerability in the nsHostResolver:: ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution. (CVE-2014-1532) The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects. (CVE-2014-1526)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia2 products
- iceape< 2.26-1.mga3
- iceape< 2.26-1.mga4
1 vendor · 2 products
References
12 linksShow all 12 references
Related vulnerabilities
MGASA-2015-0342mageiaiceape+1Updated iceape packages fix security vulnerabilities
Updated iceape packages fix security issues:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox
before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow
remote attackers to cause a denial of service (memory corruption and application
crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-0814,
CVE-2015-0815)
Use-after-free vulnerability in the AppendElements function in Mozilla Firefox
before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 on Linux,
when the Fluendo MP3 plugin for GStreamer is used, allows remote attackers to
execute arbitrary code or cause a denial of service (heap memory corruption) via
a crafted MP3 file. (CVE-2015-0813)
Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight
theme add-on installations, which allows man-in-the-middle attackers to bypass
an intended user-confirmation requirement by deploying a crafted web site and
conducting a DNS spoofing attack against a mozilla.org subdomain.
(CVE-2015-0812)
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird
before 31.6 do not properly restrict resource: URLs, which makes it easier for
remote attackers to execute arbitrary JavaScript code with chrome privileges by
leveraging the ability to bypass the Same Origin Policy, as demonstrated by the
resource: URL associated with PDF.js. (CVE-2015-0816)
The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers
to obtain sensitive information from process heap memory or cause a denial of
service (out-of-bounds read) via an image that is improperly handled during
transformation. (CVE-2015-0811)
The webrtc::VPMContentAnalysis::Release function in the WebRTC implementation in
Mozilla Firefox before 37.0 uses incompatible approaches to the deallocation of
memory for simple-type arrays, which might allow remote attackers to cause a
denial of service (memory corruption) via unspecified vectors. (CVE-2015-0808)
The navigator.sendBeacon implementation in Mozilla Firefox before 37.0, Firefox
ESR 31.x before 31.6, and Thunderbird before 31.6 processes HTTP 30x status
codes for redirects after a preflight request has occurred, which allows remote
attackers to bypass intended CORS access-control checks and conduct cross-site
request forgery (CSRF) attacks via a crafted web site, a similar issue to
CVE-2014-8638. (CVE-2015-0807)
The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before
37.0 makes an incorrect memset call during interaction with the
mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows
remote attackers to execute arbitrary code or cause a denial of service (memory
corruption and application crash) via vectors that trigger rendering of 2D
graphics content. (CVE-2015-0805)
The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before
37.0 attempts to use memset for a memory region of negative length during
interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface
function, which allows remote attackers to execute arbitrary code or cause a
denial of service (memory corruption) via vectors that trigger rendering of 2D
graphics content. (CVE-2015-0806)
The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does
not properly constrain the original data type of a casted value during the
setting of a SOURCE element's attributes, which allows remote attackers to
execute arbitrary code or cause a denial of service (use-after-free) via a
crafted HTML document. (CVE-2015-0803)
The HTMLSourceElement::BindToTree function in Mozilla Firefox before 37.0 does
not properly constrain a data type after omitting namespace validation during
certain tree-binding operations, which allows remote attackers to execute
arbitrary code or cause a denial of service (use-after-free) via a crafted HTML
document containing a SOURCE element. (CVE-2015-0804)
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird
before 31.6 allow remote attackers to bypass the Same Origin Policy and execute
arbitrary JavaScript code with chrome privileges via vectors involving anchor
navigation, a similar issue to CVE-2015-0818. (CVE-2015-0801)
Mozilla Firefox before 37.0 relies on docshell type information instead of page
principal information for Window.webidl access control, which might allow remote
attackers to execute arbitrary JavaScript code with chrome privileges via
certain content navigation that leverages the reachability of a privileged
window with an unintended persistence of access to restricted internal methods.
(CVE-2015-0802)
The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows
man-in-the-middle attackers to bypass an intended X.509 certificate-verification
step for an SSL server by specifying that server in the uri-host field of an
Alt-Svc HTTP/2 response header. (CVE-2015-0799)
Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in
Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code
or cause a denial of service (use-after-free) via a crafted plugin that does not
properly complete initialization. (CVE-2015-2706)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox
before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allow
remote attackers to cause a denial of service (memory corruption and application
crash) or possibly execute arbitrary code via unknown vectors. (CVE-2015-2708)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox
before 38.0 allow remote attackers to cause a denial of service (memory
corruption and application crash) or possibly execute arbitrary code via unknown
vectors. (CVE-2015-2709)
Heap-based buffer overflow in the SVGTextFrame class in Mozilla Firefox before
38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote
attackers to execute arbitrary code via crafted SVG graphics data in conjunction
with a crafted Cascading Style Sheets (CSS) token sequence. (CVE-2015-2710)
Mozilla Firefox before 38.0 does not recognize a referrer policy delivered by a
referrer META element in cases of context-menu navigation and middle-click
navigation, which allows remote attackers to obtain sensitive information by
reading web-server Referer logs that contain private data in a URL, as
demonstrated by a private path component. (CVE-2015-2711)
The asm.js implementation in Mozilla Firefox before 38.0 does not properly
determine heap lengths during identification of cases in which bounds checking
may be safely skipped, which allows remote attackers to trigger out-of-bounds
write operations and possibly execute arbitrary code, or trigger out-of-bounds
read operations and possibly obtain sensitive information from process memory,
via crafted JavaScript. (CVE-2015-2712)
Use-after-free vulnerability in the SetBreaks function in Mozilla Firefox before
38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote
attackers to execute arbitrary code or cause a denial of service (heap memory
corruption) via a document containing crafted text in conjunction with a
Cascading Style Sheets (CSS) token sequence containing properties related to
vertical text. (CVE-2015-2713)
Race condition in the nsThreadManager::RegisterCurrentThread function in Mozilla
Firefox before 38.0 allows remote attackers to execute arbitrary code or cause a
denial of service (use-after-free and heap memory corruption) by leveraging
improper Media Decoder Thread creation at the time of a shutdown.
(CVE-2015-2715)
Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR
31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute
arbitrary code by providing a large amount of compressed XML data.
(CVE-2015-2716)
Integer overflow in libstagefright in Mozilla Firefox before 38.0 allows remote
attackers to execute arbitrary code or cause a denial of service (heap-based
buffer overflow and out-of-bounds read) via an MP4 video file containing invalid
metadata. (CVE-2015-2717)
The WebChannel.jsm module in Mozilla Firefox before 38.0 allows remote attackers
to bypass the Same Origin Policy and obtain sensitive webchannel-response data
via a crafted web site containing an IFRAME element referencing a different web
site that is intended to read this data. (CVE-2015-2718)
Multiple integer overflows in libstagefright in Mozilla Firefox before 38.0
allow remote attackers to execute arbitrary code via crafted sample metadata in
an MPEG-4 video file. (CVE-2015-4496)MGASA-2015-0126mageiaiceapeUpdated iceape packages fix security vulnerabilities
Updated iceape packages fix security issues:
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 36.0 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute arbitrary
code via unknown vectors. (CVE-2015-0835)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before
31.5 allow remote attackers to cause a denial of service (memory corruption
and application crash) or possibly execute arbitrary code via unknown
vectors. (CVE-2015-0836)
Mozilla Firefox before 36.0 does not properly recognize the equivalence of
domain names with and without a trailing . (dot) character, which allows
man-in-the-middle attackers to bypass the HPKP and HSTS protection
mechanisms by constructing a URL with this character and leveraging access
to an X.509 certificate for a domain with this character. (CVE-2015-0832)
The WebGL implementation in Mozilla Firefox before 36.0 does not properly
allocate memory for copying an unspecified string to a shader's compilation
log, which allows remote attackers to cause a denial of service
(application crash) via crafted WebGL content. (CVE-2015-0830)
Use-after-free vulnerability in the
mozilla::dom::IndexedDB::IDBObjectStore::CreateIndex function in Mozilla
Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before
31.5 allows remote attackers to execute arbitrary code or cause a denial of
service (heap memory corruption) via crafted content that is improperly
handled during IndexedDB index creation. (CVE-2015-0831)
Buffer overflow in libstagefright in Mozilla Firefox before 36.0 allows
remote attackers to execute arbitrary code via a crafted MP4 video that is
improperly handled during playback. (CVE-2015-0829)
Double free vulnerability in the nsXMLHttpRequest::GetResponse function in
Mozilla Firefox before 36.0, when a nonstandard memory allocator is used,
allows remote attackers to execute arbitrary code or cause a denial of
service (heap memory corruption) via crafted JavaScript code that makes an
XMLHttpRequest call with zero bytes of data. (CVE-2015-0828)
Heap-based buffer overflow in the mozilla::gfx::CopyRect function in
Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird
before 31.5 allows remote attackers to obtain sensitive information from
uninitialized process memory via a malformed SVG graphic. (CVE-2015-0827)
The nsTransformedTextRun::SetCapitalization function in Mozilla Firefox
before 36.0 allows remote attackers to execute arbitrary code or cause a
denial of service (out-of-bounds read of heap memory) via a crafted
Cascading Style Sheets (CSS) token sequence that triggers a restyle or
reflow operation. (CVE-2015-0826)
Stack-based buffer underflow in the mozilla::MP3FrameParser::ParseBuffer
function in Mozilla Firefox before 36.0 allows remote attackers to obtain
sensitive information from process memory via a malformed MP3 file that
improperly interacts with memory allocation during playback.
(CVE-2015-0825)
The mozilla::layers::BufferTextureClient::AllocateForSurface function in
Mozilla Firefox before 36.0 allows remote attackers to cause a denial of
service (out-of-bounds write of zero values, and application crash) via
vectors that trigger use of DrawTarget and the Cairo library for image
drawing. (CVE-2015-0824)
The Form Autocompletion feature in Mozilla Firefox before 36.0, Firefox ESR
31.x before 31.5, and Thunderbird before 31.5 allows remote attackers to
read arbitrary files via crafted JavaScript code. (CVE-2015-0822)
Mozilla Firefox before 36.0 allows user-assisted remote attackers to read
arbitrary files or execute arbitrary JavaScript code with chrome privileges
via a crafted web site that is accessed with unspecified mouse and keyboard
actions. (CVE-2015-0821)
Mozilla Firefox before 36.0 does not properly restrict transitions of
JavaScript objects from a non-extensible state to an extensible state,
which allows remote attackers to bypass a Caja Compiler sandbox protection
mechanism or a Secure EcmaScript sandbox protection mechanism via a crafted
web site. (CVE-2015-0820)
Mozilla Firefox before 36.0.4, Firefox ESR 31.x before 31.5.3, and
SeaMonkey before 2.33.1 allow remote attackers to bypass the Same Origin
Policy and execute arbitrary JavaScript code with chrome privileges via
vectors involving SVG hash navigation. (CVE-2015-0818)
The asm.js implementation in Mozilla Firefox before 36.0.3, Firefox ESR
31.x before 31.5.2, and SeaMonkey before 2.33.1 does not properly determine
the cases in which bounds checking may be safely skipped during JIT
compilation and heap access, which allows remote attackers to read or write
to unintended memory locations, and consequently execute arbitrary code,
via crafted JavaScript. (CVE-2015-0817)MGASA-2015-0028mageiaiceapeUpdated iceape package fixes security vulnerabilities
Updated iceape packages fix security issues:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox
before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before 31.4, and
SeaMonkey before 2.32 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute arbitrary code via
unknown vectors. (CVE-2014-8634)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox
before 35.0 and SeaMonkey before 2.32 allow remote attackers to cause a denial
of service (memory corruption and application crash) or possibly execute
arbitrary code via unknown vectors. (CVE-2014-8635)
Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not properly initialize
memory for BMP images, which allows remote attackers to obtain sensitive
information from process memory via a crafted web page that triggers the
rendering of malformed BMP data within a CANVAS element. (CVE-2014-8637)
The navigator.sendBeacon implementation in Mozilla Firefox before 35.0, Firefox
ESR 31.x before 31.4, Thunderbird before 31.4, and SeaMonkey before 2.32 omits
the CORS Origin header, which allows remote attackers to bypass intended CORS
access-control checks and conduct cross-site request forgery (CSRF) attacks via
a crafted web site. (CVE-2014-8638)
Mozilla Firefox before 35.0, Firefox ESR 31.x before 31.4, Thunderbird before
31.4, and SeaMonkey before 2.32 do not properly interpret Set-Cookie headers
within responses that have a 407 (aka Proxy Authentication Required) status
code, which allows remote HTTP proxy servers to conduct session fixation attacks
by providing a cookie name that corresponds to the session cookie of the origin
server.(CVE-2014-8639)
The mozilla::dom::AudioParamTimeline::AudioNodeInputValue function in the Web
Audio API implementation in Mozilla Firefox before 35.0 and SeaMonkey before
2.32 does not properly restrict timeline operations, which allows remote
attackers to cause a denial of service (uninitialized-memory read and
application crash) via crafted API calls. (CVE-2014-8640)
Use-after-free vulnerability in the WebRTC implementation in Mozilla Firefox
before 35.0, Firefox ESR 31.x before 31.4, and SeaMonkey before 2.32 allows
remote attackers to execute arbitrary code via crafted track data.
(CVE-2014-8641)
Mozilla Firefox before 35.0 and SeaMonkey before 2.32 do not consider the
id-pkix-ocsp-nocheck extension in deciding whether to trust an OCSP responder,
which makes it easier for remote attackers to obtain sensitive information by
sniffing the network during a session in which there was an incorrect decision
to accept a compromised and revoked certificate. (CVE-2014-8642)
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey
before 2.32 does not properly interact with a DOM object that has a named
getter, which might allow remote attackers to execute arbitrary JavaScript code
with chrome privileges via unspecified vectors. (CVE-2014-8636)MGASA-2014-0518mageiaiceapeUpdated iceape package fixes security vulnerabilities
When the oxygen-gtk was active and iceape tried to draw a menu (for
example after a mouse down event on the menu bar), a segmentation
fault was triggered causing iceape to crash. The oxygen-gtk theme
engine contains a solution for this problem, this is now enabled for
iceape. (MGA #12978)
Mozilla developers and community identified and fixed several memory
safety bugs in the browser engine used in Firefox and other
Mozilla-based products. Some of these bugs showed evidence of memory
corruption under certain circumstances, and we presume that with
enough effort at least some of these could be exploited to run
arbitrary code. (CVE-2014-1587, CVE-2014-1588)
A method was found to trigger chrome level XML Binding Language (XBL)
bindings through web content. This was possible because some chrome
accessible CSS stylesheets had their primary namespace improperly
declared. When this occurred, it was possible to use these stylesheets
to manipulate XBL bindings, allowing web content to bypass security
restrictions. This issue was limited to a specific set of stylesheets.
(CVE-2014-1589)
In Iceape (seamonkey) before version 2.31, passing a JavaScript object
to XMLHttpRequest that mimics an input stream will result in a crash.
This crash is not exploitable and can only be used for denial of
service attacks. (CVE-2014-1590)
Content Security Policy (CSP) violation reports triggered by a
redirect did not remove path information as required by the CSP
specification in Iceape (seamonkey) 2.30. This potentially reveals
information about the redirect that would not otherwise be known to
the original site. This could be used by a malicious site to obtain
sensitive information such as usernames or single-sign-on tokens
encoded within the target URLs. (CVE-2014-1591)
In Iceape (seamonkey) before version 2.31, a use-after-free could be
created by triggering the creation of a second root element while
parsing HTML written to a document created with document.open(). This
leads to a potentially exploitable crash. (CVE-2014-1592)
A buffer overflow during the parsing of media content was found using
the Address Sanitizer tool. This leads to a potentially exploitable
crash. (CVE-2014-1593)
A bad casting from the BasicThebesLayer to BasicContainerLayer
resulted in undefined behavior. This behavior is potentially
exploitable with some compilers but no clear mechanism to trigger it
through web content was identified. (CVE-2014-1594)
When chrome objects are protected by Chrome Object Wrappers (COW) and
are passed as native interfaces, if this is done with some methods,
normally protected objects may be accessible to native methods exposed
to web content. (CVE-2014-8631)
When XrayWrappers filter object properties and validation of the
object initially occurs, one set of object properties will appear to
be available. Later, when the XrayWrappers are removed, a more
expansive set of properties is available. These are then stored
without further validation, making these properties available and
bypassing security protections that would normally protect them from
access. (CVE-2014-8632)MGASA-2014-0419mageiaiceape+1Updated iceape package fixes security vulnerabilities
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird
before 24.6 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute
arbitrary code via unknown vectors. (CVE-2014-1533)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 30.0 allow remote attackers to cause a denial of
service (memory corruption and application crash) or possibly execute
arbitrary code via unknown vectors. (CVE-2014-1534)
The PropertyProvider::FindJustificationRange function in Mozilla
Firefox before 30.0 allows remote attackers to execute arbitrary code
or cause a denial of service (out-of-bounds read) via unspecified
vectors. (CVE-2014-1536)
Use-after-free vulnerability in the
mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox
before 30.0 allows remote attackers to execute arbitrary code or cause
a denial of service (heap memory corruption) via unspecified vectors.
(CVE-2014-1537)
Use-after-free vulnerability in the nsTextEditRules::CreateMozBR
function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6,
and Thunderbird before 24.6 allows remote attackers to execute
arbitrary code or cause a denial of service (heap memory corruption)
via unspecified vectors. (CVE-2014-1538)
Use-after-free vulnerability in the
nsEventListenerManager::CompileEventHandlerInternal function in the
Event Listener Manager in Mozilla Firefox before 30.0 allows remote
attackers to execute arbitrary code or cause a denial of service (heap
memory corruption) via crafted web content. (CVE-2014-1540)
Use-after-free vulnerability in the RefreshDriverTimer::Tick*Driver
function in the SMIL Animation Controller in Mozilla Firefox before
30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows
remote attackers to execute arbitrary code or cause a denial of
service (heap memory corruption) via crafted web content.
(CVE-2014-1541)
Buffer overflow in the Speex resampler in the Web Audio subsystem in
Mozilla Firefox before 30.0 allows remote attackers to execute
arbitrary code via vectors related to a crafted AudioBuffer channel
count and sample rate. (CVE-2014-1542)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird
before 24.7 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute
arbitrary code via unknown vectors. (CVE-2014-1547)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers
to cause a denial of service (memory corruption and application crash)
or possibly execute arbitrary code via unknown vectors.
(CVE-2014-1548)
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer
function in Mozilla Firefox before 31.0 and Thunderbird before 31.0
does not properly allocate Web Audio buffer memory, which allows
remote attackers to execute arbitrary code or cause a denial of
service (buffer overflow and application crash) via crafted audio
content that is improperly handled during playback buffering.
(CVE-2014-1549)
Use-after-free vulnerability in the MediaInputPort class in Mozilla
Firefox before 31.0 and Thunderbird before 31.0 allows remote
attackers to execute arbitrary code or cause a denial of service (heap
memory corruption) by leveraging incorrect Web Audio control-message
ordering. (CVE-2014-1550)
Mozilla Firefox before 31.0 does not properly restrict use of
drag-and-drop events to spoof customization events, which allows
remote attackers to alter the placement of UI icons via crafted
JavaScript code that is encountered during (1) page, (2) panel, or (3)
toolbar customization. (CVE-2014-1561)
Use-after-free vulnerability in the nsDocLoader::OnProgress function
in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and
Thunderbird before 24.7 allows remote attackers to execute arbitrary
code via vectors that trigger a FireOnStateChange event.
(CVE-2014-1555)
Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and
Thunderbird before 24.7 allow remote attackers to execute arbitrary
code via crafted WebGL content constructed with the Cesium JavaScript
library. (CVE-2014-1556)
The ConvolveHorizontally function in Skia, as used in Mozilla Firefox
before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before
24.7, does not properly handle the discarding of image data during
function execution, which allows remote attackers to execute arbitrary
code by triggering prolonged image scaling, as demonstrated by scaling
of a high-quality image. (CVE-2014-1557)
Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote
attackers to cause a denial of service (X.509 certificate parsing
outage) via a crafted certificate that does not use UTF-8 character
encoding in a required context, a different vulnerability than
CVE-2014-1559. (CVE-2014-1558)
Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote
attackers to cause a denial of service (X.509 certificate parsing
outage) via a crafted certificate that does not use UTF-8 character
encoding in a required context, a different vulnerability than
CVE-2014-1558. (CVE-2014-1559)
Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote
attackers to cause a denial of service (X.509 certificate parsing
outage) via a crafted certificate that does not use ASCII character
encoding in a required context. (CVE-2014-1560)
Mozilla Firefox before 31.0 and Thunderbird before 31.0 do not
properly implement the sandbox attribute of the IFRAME element, which
allows remote attackers to bypass intended restrictions on same-origin
content via a crafted web site in conjunction with a redirect.
(CVE-2014-1552)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird
31.x before 31.1 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute
arbitrary code via unknown vectors. (CVE-2014-1553)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 32.0 allow remote attackers to cause a denial of
service (memory corruption and application crash) or possibly execute
arbitrary code via unknown vectors. (CVE-2014-1554)
Unspecified vulnerability in the browser engine in Mozilla Firefox
before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and
Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote
attackers to cause a denial of service (memory corruption and
application crash) or possibly execute arbitrary code via unknown
vectors. (CVE-2014-1562)
Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff
function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1,
and Thunderbird 31.x before 31.1 allows remote attackers to execute
arbitrary code or cause a denial of service (heap memory corruption)
via an SVG animation with DOM interaction that triggers incorrect
cycle collection. (CVE-2014-1563)
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and
Thunderbird 31.x before 31.1 do not properly initialize memory for GIF
rendering, which allows remote attackers to obtain sensitive
information from process memory via crafted web script that interacts
with a CANVAS element associated with a malformed GIF image.
(CVE-2014-1564)
Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla
Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before
31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows
remote attackers to execute arbitrary code via text that is improperly
handled during the interaction between directionality resolution and
layout. (CVE-2014-1567)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird
31.x before 31.2 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute
arbitrary code via unknown vectors. (CVE-2014-1574)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 33.0 allow remote attackers to cause a denial of
service (memory corruption and application crash) or possibly execute
arbitrary code via vectors related to improper interaction between
threading and garbage collection in the GCRuntime::triggerGC function
in js/src/jsgc.cpp, and unknown other vectors. ()
Heap-based buffer overflow in the nsTransformedTextRun function in
Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and
Thunderbird 31.x before 31.2 allows remote attackers to execute
arbitrary code via Cascading Style Sheets (CSS) token sequences that
trigger changes to capitalization style. (CVE-2014-1576)
The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the
Web Audio subsystem in Mozilla Firefox before 33.0, Firefox ESR 31.x
before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers
to obtain sensitive information from process memory or cause a denial
of service (out-of-bounds read, memory corruption, and application
crash) via an invalid custom waveform that triggers a calculation of a
negative frequency value. (CVE-2014-1577)
The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x
before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers
to cause a denial of service (out-of-bounds write and application
crash) or possibly execute arbitrary code via WebM frames with invalid
tile sizes that are improperly handled in buffering operations during
video playback. (CVE-2014-1578)
Mozilla Firefox before 33.0 does not properly initialize memory for
GIF images, which allows remote attackers to obtain sensitive
information from process memory via a crafted web page that triggers a
sequence of rendering operations for truncated GIF data within a
CANVAS element. (CVE-2014-1580)
Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla
Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird
31.x before 31.2 allows remote attackers to execute arbitrary code via
text that is improperly handled during the interaction between
directionality resolution and layout. (CVE-2014-1581)
The Public Key Pinning (PKP) implementation in Mozilla Firefox before
33.0 does not properly consider the connection-coalescing behavior of
SPDY and HTTP/2 in the case of a shared IP address, which allows
man-in-the-middle attackers to bypass an intended pinning
configuration and spoof a web site by providing a valid certificate
from an arbitrary recognized Certification Authority. (CVE-2014-1582)
The Public Key Pinning (PKP) implementation in Mozilla Firefox before
33.0 skips pinning checks upon an unspecified issuer-verification
error, which makes it easier for remote attackers to bypass an
intended pinning configuration and spoof a web site via a crafted
certificate that leads to presentation of the Untrusted Connection
dialog to the user. (CVE-2014-1584)
The WebRTC video-sharing feature in dom/media/MediaManager.cpp in
Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and
Thunderbird 31.x before 31.2 does not properly recognize Stop Sharing
actions for videos in IFRAME elements, which allows remote attackers
to obtain sensitive information from the local camera by maintaining a
session after the user tries to discontinue streaming. (CVE-2014-1585)
content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0,
Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does
not consider whether WebRTC video sharing is occurring, which allows
remote attackers to obtain sensitive information from the local camera
in certain IFRAME situations by maintaining a session after the user
temporarily navigates away. (CVE-2014-1586)
The Alarm API in Mozilla Firefox before 33.0 and Firefox ESR 31.x
before 31.2 does not properly restrict toJSON calls, which allows
remote attackers to bypass the Same Origin Policy via crafted API
calls that access sensitive information within the JSON data of an
alarm. (CVE-2014-1583)MGASA-2014-0146mageiaiceape+1Updated iceape packages fix multiple vulnerabilities
Updated iceape packages fix security issues:
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4,
and SeaMonkey before 2.25 allow remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute arbitrary
code via unknown vectors. (CVE-2014-1493)
Multiple unspecified vulnerabilities in the browser engine in Mozilla
Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause
a denial of service (memory corruption and application crash) or possibly
execute arbitrary code via unknown vectors. (CVE-2014-1494)
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird
before 24.4, and SeaMonkey before 2.25 might allow local users to gain
privileges by modifying the extracted Mar contents during an update.
(CVE-2014-1496)
mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before
28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey
before 2.25 allows remote attackers to obtain sensitive information from
process heap memory, cause a denial of service (out-of-bounds read and
application crash), or possibly have unspecified other impact via a crafted
WAV file. (CVE-2014-1497)
The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and
SeaMonkey before 2.25 does not properly validate a certain key type, which
allows remote attackers to cause a denial of service (application crash)
via vectors that trigger generation of a key that supports the Elliptic
Curve ec-dual-use algorithm. (CVE-2014-1498)
Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote
attackers to spoof the domain name in the WebRTC (1) camera or (2)
microphone permission prompt by triggering navigation at a certain time
during generation of this prompt. (CVE-2014-1499)
Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote
attackers to cause a denial of service (resource consumption and
application hang) via onbeforeunload events that trigger background
JavaScript execution. (CVE-2014-1500)
The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D
functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow
remote attackers to bypass the Same Origin Policy and render content in a
different domain via unspecified vectors. (CVE-2014-1502)
The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey
before 2.25 does not consider the Content Security Policy of a data: URL,
which makes it easier for remote attackers to conduct cross-site scripting
(XSS) attacks via a crafted document that is accessed after a browser
restart. (CVE-2014-1504)
The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0,
Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before
2.25 allows remote attackers to obtain sensitive information from process
memory, cause a denial of service (out-of-bounds read and application
crash), or possibly bypass the Same Origin Policy via vectors involving
MathML polygon rendering. (CVE-2014-1508)
Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as
used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4,
Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers
to execute arbitrary code via a crafted extension that renders fonts in a
PDF document. (CVE-2014-1509)
SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x
before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows
remote attackers to obtain sensitive displacement-correlation information,
and possibly bypass the Same Origin Policy and read text from a different
domain, via a timing attack involving feDisplacementMap elements, a related
issue to CVE-2013-1693. (CVE-2014-1505)
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x
before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows
remote attackers to execute arbitrary JavaScript code with chrome
privileges by using an IDL fragment to trigger a window.open call.
(CVE-2014-1510)
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird
before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the
popup blocker via unspecified vectors. (CVE-2014-1511)
Use-after-free vulnerability in the TypeObject class in the JavaScript
engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4,
Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers
to execute arbitrary code by triggering extensive memory consumption while
garbage collection is occurring. (CVE-2014-1512)
TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x
before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not
prevent a zero-length transition during use of an ArrayBuffer object, which
allows remote attackers to execute arbitrary code or cause a denial of
service (heap-based out-of-bounds write or read) via a crafted web site.
(CVE-2014-1513)
vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x
before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not
validate the length of the destination array before a copy operation, which
allows remote attackers to execute arbitrary code or cause a denial of
service (out-of-bounds write and application crash) by triggering incorrect
use of the TypedArrayObject class. (CVE-2014-1514)