CVE-2014-1557

Oracle Solaris < 30.0 - Code Injection

Title source: rule
STIX 2.1

Description

The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.

References (18)

Core 18
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59719
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60083
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60621
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/68824
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201504-01
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60306
Various Sources x_refsource_confirm
http://linux.oracle.com/errata/ELSA-2014-0918.html
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=913805
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2996
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1030619
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60486
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60628
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2014/dsa-2986
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59760
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/59591
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1030620

Scores

EPSS 0.0243
EPSS Percentile 85.4%

Details

CWE
CWE-94
Status published
Products (23)
debian/debian_linux 6.0
debian/debian_linux 7.0
mozilla/firefox 24.0
mozilla/firefox 24.0.1
mozilla/firefox 24.0.2
mozilla/firefox 24.1.0
mozilla/firefox 24.1.1
mozilla/firefox < 30.0
mozilla/firefox_esr 24.2
mozilla/firefox_esr 24.3
... and 13 more
Published Jul 23, 2014
Tracked Since Feb 18, 2026