CVE-2014-1512

high · 10

Use-after-free vulnerability in the TypeObject class in the JavaScript engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary code by triggering extensive memory consumption while garbage collection is occurring, as demonstrated by improper handling of BumpChunk objects.

CVSS

29.3%

EPSS (exploit prob.)

98th

EPSS percentile

2014-03-19

Published

AV:N/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

CWE-416

Affected products

Vendor	Product	Affected versions
mozilla	firefox	< 28.0
mozilla	firefox	>= 24.0, < 24.4
mozilla	seamonkey	< 2.25
mozilla	thunderbird	< 24.4
debian	debian_linux	7.0
debian	debian_linux	8.0
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10
canonical	ubuntu_linux	13.10
redhat	enterprise_linux_desktop	5.0
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_eus	6.5
redhat	enterprise_linux_server	5.0
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server_aus	6.5
redhat	enterprise_linux_server_eus	6.5
redhat	enterprise_linux_server_tus	6.5
redhat	enterprise_linux_workstation	5.0
redhat	enterprise_linux_workstation	6.0
suse	suse_linux_enterprise_software_development_kit	11.0
opensuse	opensuse	11.4
opensuse	opensuse	12.3
opensuse	opensuse	13.1
suse	suse_linux_enterprise_desktop	11
suse	suse_linux_enterprise_server	11
suse	suse_linux_enterprise_server	11

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-1512