CVE-2014-1580

Published: Oct 15, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Mozilla Firefox before 33.0 does not properly initialize memory for GIF images, which allows remote attackers to obtain sensitive information from process memory via a crafted web page that triggers a sequence of rendering operations for truncated GIF data within a CANVAS element.

Affected (4)

Products: Mozilla: Firefox

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 32.0
Mozilla Firefox	Version 30.0
Mozilla Firefox	Version 31.0
Mozilla Firefox	Version 31.1.0

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (26)

http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html

Source: security@mozilla.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html

Source: security@mozilla.org

http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html

Source: security@mozilla.org

http://secunia.com/advisories/62022

Source: security@mozilla.org

http://secunia.com/advisories/62023

Source: security@mozilla.org

http://www.mozilla.org/security/announce/2014/mfsa2014-78.html

Source: security@mozilla.org

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: security@mozilla.org

http://www.securityfocus.com/bid/70431

Source: security@mozilla.org

http://www.securitytracker.com/id/1031028

Source: security@mozilla.org

http://www.ubuntu.com/usn/USN-2372-1

Source: security@mozilla.org

https://bugzilla.mozilla.org/show_bug.cgi?id=1063733

Source: security@mozilla.org

https://security.gentoo.org/glsa/201504-01

Source: security@mozilla.org

http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/62022

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/62023

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.mozilla.org/security/announce/2014/mfsa2014-78.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/70431

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id/1031028

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-2372-1

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.mozilla.org/show_bug.cgi?id=1063733

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201504-01

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.