CRITICAL: CVE-2014-1537 (CVSS 10) — mozilla firefox

CVE: CVE-2014-1537

CVSS: 10 (2.0) — AV:N/AC:L/Au:N/C:C/I:C/A:C

Severity: CRITICAL

Status: Critical advisory

Affected

• mozilla firefox

Summary

Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

Verified Sources

• NVD entry
• GitHub Advisory
• MITRE

References

• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00019.html
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00023.html
• http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html
• http://lists.opensuse.org/opensuse-updates/2014-07/msg00001.html
• http://lists.opensuse.org/opensuse-updates/2014-07/msg00004.html
• http://secunia.com/advisories/59052
• http://secunia.com/advisories/59171
• http://secunia.com/advisories/59229
• http://secunia.com/advisories/59377
• http://secunia.com/advisories/59387

_Validated by the Lyrie Threat Intelligence Pipeline — 3 independent sources confirmed before publication. No speculation._