CVE-2014-1551

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-23 · updated 2026-06-17

Description

Use-after-free vulnerability in the FontTableRec destructor in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 on Windows allows remote attackers to execute arbitrary code via crafted use of fonts in MathML content, leading to improper handling of a DirectWrite font-face object.

Affected products

Mozilla Firefox: through 30.0; 24.0, 24.0.1, 24.0.2, 24.1.0, 24.1.1
Mozilla Firefox ESR: 24.2, 24.3, 24.4, 24.5, 24.6
Mozilla Thunderbird: through 24.6; 24.0, 24.0.1, 24.1, 24.1.1, 24.2, 24.3 (+2)

References

http://secunia.com/advisories/59760
http://www.mozilla.org/security/announce/2014/mfsa2014-59.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securitytracker.com/id/1030619
http://www.securitytracker.com/id/1030620
https://bugzilla.mozilla.org/show_bug.cgi?id=1018234
https://security.gentoo.org/glsa/201504-01
http://secunia.com/advisories/59760
http://www.mozilla.org/security/announce/2014/mfsa2014-59.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securitytracker.com/id/1030619
http://www.securitytracker.com/id/1030620

Get alerted when CVE-2014-1551 or the next vulnerability affects your stack