Vulnerability Description
Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Evergreen | 11.4 |
| Opensuse | Opensuse | 12.3 |
| Mozilla | Firefox | <= 31.1.0 |
| Mozilla | Thunderbird | 31.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
- http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.htmlThird Party Advisory
- http://packetstormsecurity.com/files/128132/Mozilla-Firefox-Secret-Leak.html
- http://seclists.org/fulldisclosure/2014/Sep/18
- http://secunia.com/advisories/60148
- http://secunia.com/advisories/61114
- http://www.mozilla.org/security/announce/2014/mfsa2014-69.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/archive/1/533357/100/0/threaded
- http://www.securityfocus.com/bid/69525
- http://www.securitytracker.com/id/1030793
- http://www.securitytracker.com/id/1030794
- https://bugzilla.mozilla.org/show_bug.cgi?id=1045977Issue Tracking
FAQ
What is CVE-2014-1564?
CVE-2014-1564 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive infor...
How severe is CVE-2014-1564?
CVE-2014-1564 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-1564?
Check the references section above for vendor advisories and patch information. Affected products include: Opensuse Evergreen, Opensuse Opensuse, Mozilla Firefox, Mozilla Thunderbird.