CyberSec.Space Logo
Back to CVE Browser

CVE-2014-1488

CRITICAL
10.0
CVSS Severity Score
EPSS Score0.0450%
EPSS Percentile17.73th
PublishedFeb 6, 2014
Last ModifiedApr 29, 2026

Vulnerability Description

The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js.

Affected Platforms (CPE)

📦
Mozilla

Firefox

< 27.0
📦
Mozilla

Seamonkey

< 2.24
💻
Canonical

Ubuntu Linux

= 12.04
💻
Canonical

Ubuntu Linux

= 12.10
💻
Canonical

Ubuntu Linux

= 13.10
💻
Oracle

Solaris

= 11.3
💻
Opensuse

Opensuse

= 12.3
💻
Opensuse

Opensuse

= 13.1
💻
Suse

Linux Enterprise Desktop

= 11
💻
Suse

Linux Enterprise Server

= 11
💻
Suse

Linux Enterprise Server

= 11
💻
Suse

Linux Enterprise Software Development Kit

= 11

References & Advisories

🔗 http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
🔗 http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
🔗 http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
🔗 http://osvdb.org/102875
🔗 http://secunia.com/advisories/56706
🔗 http://secunia.com/advisories/56767
🔗 http://secunia.com/advisories/56787
🔗 http://secunia.com/advisories/56888

Related Vulnerabilities

CVE-2019-1170810.0

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the no...

CVE-2019-2513610.0

A compromised child process could have injected XBL Bindings into privileged CSS rules, resulting in arbitrary code execution and ...

CVE-2018-1850510.0

An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication betwee...

CVE-2020-1238810.0

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this iss...