CVE-2014-1525

Currently unrated

Key Information:

Vendor
Mozilla
Status
Firefox
Seamonkey
Vendor
CVE Published:
30 April 2014

Summary

The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document.

References

http://lists.opensuse.org/opensuse-updates/2014-05/msg000...
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2014-05/msg000...
vendor-advisoryx_refsource_SUSE
https://security.gentoo.org/glsa/201504-01
vendor-advisoryx_refsource_GENTOO

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.