peter bassill · operator
$ cve CVE-2014-1514 JSON

CVE-2014-1514

9.8
CRITICAL · CVSS 3.1 · EPSS 6.1% (pctl 93)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the destination array before a copy operation, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by triggering incorrect use of the TypedArrayObject class.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS6.09% — more likely to be exploited than 93% of all CVEs
WeaknessCWE-787
On CISA KEVno
Public exploitnone known
Published2014-03-19
Last modified2026-06-17

Affected (16)

VendorProduct
canonicalubuntu linux
debiandebian linux
mozillafirefox
mozillaseamonkey
mozillathunderbird
opensuseopensuse
redhatenterprise linux desktop
redhatenterprise linux eus
redhatenterprise linux server
redhatenterprise linux server aus
redhatenterprise linux server eus
redhatenterprise linux server tus
redhatenterprise linux workstation
susesuse linux enterprise desktop
susesuse linux enterprise server
susesuse linux enterprise software development kit

References

→ the Explorer  ·  watch your stack  ·  NVD