CVE-2014-1556

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-23 · updated 2026-06-17
Weakness: CWE-94

Description

Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to execute arbitrary code via crafted WebGL content constructed with the Cesium JavaScript library.

Affected products

Mozilla Firefox: through 30.0; 24.0, 24.0.1, 24.0.2, 24.1.0, 24.1.1
Mozilla Firefox ESR: 24.2, 24.3, 24.4, 24.5, 24.6
Mozilla Thunderbird: through 24.6; 24.0, 24.0.1, 24.1, 24.1.1, 24.2, 24.3 (+2)

References

http://linux.oracle.com/errata/ELSA-2014-0918.html
http://secunia.com/advisories/59591
http://secunia.com/advisories/59719
http://secunia.com/advisories/59760
http://secunia.com/advisories/60083
http://secunia.com/advisories/60306
http://secunia.com/advisories/60486
http://secunia.com/advisories/60621
http://secunia.com/advisories/60628
http://www.debian.org/security/2014/dsa-2986
http://www.debian.org/security/2014/dsa-2996
http://www.mozilla.org/security/announce/2014/mfsa2014-62.html

Get alerted when CVE-2014-1556 or the next vulnerability affects your stack