CVE-2014-1532: Use After Free
Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 29.0 - Upgrade
Upgrade
Mozilla Firefox ESR 24.xto a version that resolves this vulnerability.Fixed in 24.5 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 24.5 - Upgrade
Upgrade
Mozilla SeaMonkeyto a version that resolves this vulnerability.Fixed in 2.26
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1532?
CVE-2014-1532 is considered critical, allowing remote attackers to execute arbitrary code or cause a denial of service.
How do I fix CVE-2014-1532?
To fix CVE-2014-1532, update your affected Mozilla applications to the latest versions available.
Which software is affected by CVE-2014-1532?
CVE-2014-1532 affects Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26.
What is a use-after-free vulnerability as seen in CVE-2014-1532?
A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, which can lead to arbitrary code execution.
Is there any exploitation risk associated with CVE-2014-1532?
Yes, CVE-2014-1532 poses a significant exploitation risk, as attackers can exploit this vulnerability to take control of affected systems.