CVE-2014-1524: Buffer Overflow
The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 29.0 - Upgrade
Upgrade
Mozilla Firefox ESR 24.xto a version that resolves this vulnerability.Fixed in 24.5 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 24.5 - Upgrade
Upgrade
Mozilla SeaMonkeyto a version that resolves this vulnerability.Fixed in 2.26
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1524?
CVE-2014-1524 is classified as a critical vulnerability that can allow remote code execution.
How do I fix CVE-2014-1524?
To fix CVE-2014-1524, update affected software such as Mozilla Firefox, Thunderbird, or SeaMonkey to the latest versions.
Which versions are affected by CVE-2014-1524?
CVE-2014-1524 affects Mozilla Firefox versions prior to 29.0, Thunderbird versions prior to 24.5, SeaMonkey versions prior to 2.26, and specific versions of Firefox ESR.
What types of attacks can exploit CVE-2014-1524?
CVE-2014-1524 can be exploited by remote attackers to execute arbitrary code or cause a denial of service.
Is there a specific platform where CVE-2014-1524 is a concern?
CVE-2014-1524 is a concern on multiple platforms including Windows, Linux distributions such as Ubuntu and Debian, and various versions of Red Hat Linux.