Home > Vulnerability Database > CVE-2014-1564

Mend.io Vulnerability Database

CVE-2014-1564

Date: September 3, 2014

Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.

Severity Score

3.7

Related Resources (19)

Url: http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html

Url: http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.html

Url: http://www.securityfocus.com/bid/69525

Url: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html

Url: http://www.mozilla.org/security/announce/2014/mfsa2014-69.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2014-1564

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=1045977

Url: http://www.securitytracker.com/id/1030794

Url: http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.html

Url: http://www.securitytracker.com/id/1030793

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2014-1564

Url: http://www.securityfocus.com/archive/1/533357/100/0/threaded

Url: http://secunia.com/advisories/61114

Url: http://packetstormsecurity.com/files/128132/Mozilla-Firefox-Secret-Leak.html

Url: http://seclists.org/fulldisclosure/2014/Sep/18

Url: https://security.gentoo.org/glsa/201504-01

Url: http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Url: http://secunia.com/advisories/60148

Url: https://www.mend.io/vulnerability-database/CVE-2014-1564

Severity Score

3.7

Weakness Type (CWE)

Access of Uninitialized Pointer

CWE-824

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	LOW
Integrity (I):	NONE
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	NONE
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2014-1564

Date: September 3, 2014

Severity Score

Related Resources (19)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?