CVE-2014-1509

CVSS v3.1 8.8 (High)

CVSS v2.0 6.8 (Medium)

EPSS 2.23 % (90^th)

Affected Products 16

Advisories 10

Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25, allows remote attackers to execute arbitrary code via a crafted extension that renders fonts in a PDF document.

Weaknesses

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE Status: PUBLISHED
CNA: Mozilla Corporation
Published Date: 2014-03-19 10:55:06
(10 years ago)
Updated Date: 2020-08-03 16:08:16
(4 years ago)

Affected Products

Canonical

Ubuntu Linux

Mozilla

Opensuse

Opensuse

Redhat

Suse

Configuration #1

	CPE23	From	Up To
Mozilla Firefox prior 28.0 version	cpe:2.3:a:mozilla:firefox		< 28.0
Mozilla Firefox Esr from 24.0 version and prior 24.4 version	cpe:2.3:a:mozilla:firefox_esr	>= 24.0	< 24.4
Mozilla Seamonkey prior 2.25 version	cpe:2.3:a:mozilla:seamonkey		< 2.25
Mozilla Thunderbird prior 24.4 version	cpe:2.3:a:mozilla:thunderbird		< 24.4

Configuration #2

		CPE23	From	Up To
	Redhat Enterprise Linux Desktop 5.0	cpe:2.3:o:redhat:enterprise_linux_desktop:5.0
	Redhat Enterprise Linux Desktop 6.0	cpe:2.3:o:redhat:enterprise_linux_desktop:6.0
	Redhat Enterprise Linux Eus 6.5	cpe:2.3:o:redhat:enterprise_linux_eus:6.5
	Redhat Enterprise Linux Server 5.0	cpe:2.3:o:redhat:enterprise_linux_server:5.0
	Redhat Enterprise Linux Server 6.0	cpe:2.3:o:redhat:enterprise_linux_server:6.0
	Redhat Enterprise Linux Server Aus 6.5	cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5
	Redhat Enterprise Linux Server Eus 6.5	cpe:2.3:o:redhat:enterprise_linux_server_eus:6.5
	Redhat Enterprise Linux Server Tus 6.5	cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5
	Redhat Enterprise Linux Workstation 5.0	cpe:2.3:o:redhat:enterprise_linux_workstation:5.0
	Redhat Enterprise Linux Workstation 6.0	cpe:2.3:o:redhat:enterprise_linux_workstation:6.0

Configuration #3

		CPE23	From	Up To
	Canonical Ubuntu Linux 12.04	cpe:2.3:o:canonical:ubuntu_linux:12.04:::*:esm
	Canonical Ubuntu Linux 12.10	cpe:2.3:o:canonical:ubuntu_linux:12.10
	Canonical Ubuntu Linux 13.10	cpe:2.3:o:canonical:ubuntu_linux:13.10

Configuration #4

		CPE23	From	Up To
	Suse Linux Enterprise Software Development Kit 11.0 SP3	cpe:2.3:a:suse:suse_linux_enterprise_software_development_kit:11.0:sp3
	Opensuse 11.4	cpe:2.3:o:opensuse:opensuse:11.4
	Opensuse 12.3	cpe:2.3:o:opensuse:opensuse:12.3
	Opensuse 13.1	cpe:2.3:o:opensuse:opensuse:13.1
	Suse Linux Enterprise Desktop 11 SP3	cpe:2.3:o:suse:suse_linux_enterprise_desktop:11:sp3
	Suse Linux Enterprise Server 11 SP3	cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3
	Suse Linux Enterprise Server 11 SP3 for Vmware	cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:::*:vmware