CVE-2014-1545: Critical severity Mozilla Netscape Portable Runtime vulnerability
Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.
Other sources
Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team reported an out of bounds write in the Netscape Portable Runtime (NSPR) leading to a potentially exploitable crash or code execution. This issue is fixed in NSPR version 4.10.6.
This NSPR flaw was not exposed to web content in any shipped version of Firefox.
External Reference:
http://www.mozilla.org/security/announce/2014/mfsa2014-55.html
Acknowledgements:
Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Abhishek Arya as the original reporter.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1545?
CVE-2014-1545 has been rated as a critical vulnerability due to its potential to allow remote code execution or denial of service.
How do I fix CVE-2014-1545?
To fix CVE-2014-1545, upgrade Mozilla Netscape Portable Runtime to version 4.10.6 or later.
Who discovered the vulnerability CVE-2014-1545?
CVE-2014-1545 was reported by security researcher Abhishek Arya of the Google Chrome Security Team.
What action can remote attackers perform due to CVE-2014-1545?
Remote attackers can exploit CVE-2014-1545 to execute arbitrary code or cause a denial of service through specific functions.
What software versions are affected by CVE-2014-1545?
CVE-2014-1545 affects all versions of Mozilla Netscape Portable Runtime prior to 4.10.6, including versions like 4.10.5 and older.