Skip to content
CVSS 8.8 · HIGH

CVE-2014-1497

The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.

Ver en NVD

Severidad

Puntaje: 8.8(HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: REQUIRED
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH
Tipo de falla (CWE): CWE-125

EPSS

Probabilidad de explotación (próx. 30 días): 0.0050 (0.5%)
Percentil: 66.1%
EPSS: 2026-05-06

Afecta

mozilla:firefoxmozilla:seamonkeymozilla:thunderbirddebian:debian_linuxsuse:suse_linux_enterprise_software_development_kitopensuse:opensusesuse:suse_linux_enterprise_desktopsuse:suse_linux_enterprise_servercanonical:ubuntu_linuxredhat:enterprise_linux_desktopredhat:enterprise_linux_eusredhat:enterprise_linux_serverredhat:enterprise_linux_server_ausredhat:enterprise_linux_server_eusredhat:enterprise_linux_server_tusredhat:enterprise_linux_workstation

Descripción técnica

The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive information from process heap memory, cause a denial of service (out-of-bounds read and application crash), or possibly have unspecified other impact via a crafted WAV file.

Publicada: 19/3/2014, 10:55:06
Última modificación: 6/5/2026, 22:30:45

Referencias

InicioEventosBlogRecursosEquipo