Skip to content
OpenAdvisories
Unscored CVE-2014-1565 EUVD-2014-1641GHSA-4444-m42x-r3q8

The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32.0, Firefox ESR 31.x before 3…

Published Sep 3, 2014 · Updated Aug 6, 2024 · Assigned by mozilla

Package: firefox Package: thunderbird Ecosystem: Ubuntu

Description

The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 does not properly create audio timelines, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via crafted API calls.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS firefox 32.0+build1-0ubuntu0.14.04.1 USN-2329-1
Ubuntu 14.04 LTS thunderbird 1:31.1.1+build1-0ubuntu0.14.04.1 USN-2330-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 50.1.0-1.1 openSUSE-SU-2024:10071-1
openSUSE Tumbleweed MozillaThunderbird 45.5.1-1.1 openSUSE-SU-2024:10230-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 5

References