What’s Vulnerable › Vulnerabilities
CVE-2014-1477
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2014-02-06 · updated 2026-06-17
Description
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Affected products
- Canonical Ubuntu Linux: 12.04, 12.10, 13.10
- Debian Linux: 7.0
- Fedoraproject Fedora: 19, 20
- Mozilla Firefox: before 27.0; from 24.0 before 24.3 — fixed in 24.3, 27.0
- Mozilla Seamonkey: before 2.24 — fixed in 2.24
- Mozilla Thunderbird: before 24.3 — fixed in 24.3
- Opensuse: 11.4, 12.3, 13.1
- RedHat Enterprise Linux Desktop: 5.0, 6.0
- RedHat Enterprise Linux Eus: 6.5
- RedHat Enterprise Linux Server: 5.0, 6.0
- RedHat Enterprise Linux Server Aus: 6.5
- RedHat Enterprise Linux Server Eus: 6.5
- RedHat Enterprise Linux Server Tus: 6.5
- RedHat Enterprise Linux Workstation: 5.0, 6.0
- Suse Linux Enterprise Desktop: 11-sp3
- SUSE Linux Enterprise: 11-sp3
- Suse Linux Enterprise Software Development Kit: 11.0-sp3
How to fix
Upgrade to a fixed version: Mozilla Firefox 24.3, 27.0; Mozilla Seamonkey 2.24; Mozilla Thunderbird 24.3. Check the vendor advisory for mitigations.
References
- http://download.novell.com/Download?buildid=VYQsgaFpQ2k
- http://download.novell.com/Download?buildid=Y2fux-JW1Qc
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
- http://osvdb.org/102864
- http://rhn.redhat.com/errata/RHSA-2014-0132.html
- http://rhn.redhat.com/errata/RHSA-2014-0133.html
- http://secunia.com/advisories/56706
Get alerted when CVE-2014-1477 or the next vulnerability affects your stack