CVE-2014-1553
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0,...
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Exploit likelihood
What each source reports
NVD Score used
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- Record
CVE-2014-1553- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- Record
CVE-2014-1553- Updated
- 2026-11-02
EUVDEUVD-2014-1629 No score
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- Record
EUVD-2014-1629- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rvvr-h4rh-2hm5 No score
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0,...
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- Record
GHSA-rvvr-h4rh-2hm5- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVMGASA-2014-0419 No score
Updated iceape package fixes security vulnerabilities
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1533)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1534)
The PropertyProvider::FindJustificationRange function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors. (CVE-2014-1536)
Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2014-1537)
Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2014-1538)
Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content. (CVE-2014-1540)
Use-after-free vulnerability in the RefreshDriverTimer::Tick*Driver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content. (CVE-2014-1541)
Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate. (CVE-2014-1542)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1547)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1548)
The mozilla::dom::AudioBufferSourceNodeEngine::CopyFromInputBuffer function in Mozilla Firefox before 31.0 and Thunderbird before 31.0 does not properly allocate Web Audio buffer memory, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted audio content that is improperly handled during playback buffering. (CVE-2014-1549)
Use-after-free vulnerability in the MediaInputPort class in Mozilla Firefox before 31.0 and Thunderbird before 31.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) by leveraging incorrect Web Audio control-message ordering. (CVE-2014-1550)
Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization. (CVE-2014-1561)
Use-after-free vulnerability in the nsDocLoader::OnProgress function in…
- Record
MGASA-2014-0419- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
Show 5 moreShow less
OSVopenSUSE-SU-2024:10230-1 No score
MozillaThunderbird-45.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10230-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-1553 No score
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
- Record
UBUNTU-CVE-2014-1553- Updated
- 2026-11-02
OSVUSN-2329-1 No score
firefox vulnerabilities
Jan de Mooij, Christian Holler, Karl Tomlinson, Randell Jesup, Gary Kwong, Jesse Ruderman, JW Wang and David Weir discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1553, CVE-2014-1554, CVE-2014-1562)
Abhishek Arya discovered a use-after-free during DOM interactions with SVG. If a user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1563)
Michal Zalewski discovered that memory is not initialized properly during GIF rendering in some circumstances. If a user were tricked in to opening a specially crafted page, an attacker could potentially exploit this to steal confidential information. (CVE-2014-1564)
Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or steal confidential information. (CVE-2014-1565)
A use-after-free was discovered during text layout in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-1567)
- Record
USN-2329-1- Updated
- 2026-11-02
OSVUSN-2330-1 No score
thunderbird vulnerabilities
Jan de Mooij, Christian Holler, Karl Tomlinson, Randell Jesup, Gary Kwong, Jesse Ruderman and JW Wang discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1553, CVE-2014-1562)
Abhishek Arya discovered a use-after-free during DOM interactions with SVG. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1563)
Michal Zalewski discovered that memory is not initialized properly during GIF rendering in some circumstances. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to steal confidential information. (CVE-2014-1564)
Holger Fuhrmannek discovered an out-of-bounds read in Web Audio. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or steal confidential information. (CVE-2014-1565)
A use-after-free was discovered during text layout in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2014-1567)
- Record
USN-2330-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceapeMageia:3 From an advisory covering 39 CVEs |
before 2.30-1.mga3 | 2.30-1.mga3 |
iceapeMageia:4 From an advisory covering 39 CVEs |
before 2.30-1.mga4 | 2.30-1.mga4 |
firefoxUbuntu:14.04:LTS |
before 32.0+build1-0ubuntu0.14.04.1, plus listed versions 24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1 Show 4 moreShow less28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.1 |
32.0+build1-0ubuntu0.14.04.1 |
thunderbirdUbuntu:14.04:LTS |
before 1:31.1.1+build1-0ubuntu0.14.04.1, plus listed versions 1:24.0+build1-0ubuntu11:24.0+build1-0ubuntu21:24.1.1+build1-0ubuntu0.13.10.11:24.1.1+build1-0ubuntu11:24.2.0+build1-0ubuntu1 Show 4 moreShow less1:24.4.0+build1-0ubuntu11:24.5.0+build1-0ubuntu0.14.04.11:24.6.0+build1-0ubuntu0.14.04.11:31.0+build1-0ubuntu0.14.04.1 |
1:31.1.1+build1-0ubuntu0.14.04.1 |
firefoxUbuntu:14.04:LTS From an advisory covering 7 CVEs |
before 32.0+build1-0ubuntu0.14.04.1, plus listed versions 24.0+build1-0ubuntu125.0+build3-0ubuntu0.13.10.128.0~b2+build1-0ubuntu228.0+build1-0ubuntu128.0+build2-0ubuntu1 Show 4 moreShow less28.0+build2-0ubuntu229.0+build1-0ubuntu0.14.04.230.0+build1-0ubuntu0.14.04.331.0+build1-0ubuntu0.14.04.1 |
32.0+build1-0ubuntu0.14.04.1 |
thunderbirdUbuntu:14.04:LTS From an advisory covering 6 CVEs |
before 1:31.1.1+build1-0ubuntu0.14.04.1, plus listed versions 1:24.0+build1-0ubuntu11:24.0+build1-0ubuntu21:24.1.1+build1-0ubuntu0.13.10.11:24.1.1+build1-0ubuntu11:24.2.0+build1-0ubuntu1 Show 4 moreShow less1:24.4.0+build1-0ubuntu11:24.5.0+build1-0ubuntu0.14.04.11:24.6.0+build1-0ubuntu0.14.04.11:31.0+build1-0ubuntu0.14.04.1 |
1:31.1.1+build1-0ubuntu0.14.04.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 899 CVEs |
before 50.1.0-1.1 | 50.1.0-1.1 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 560 CVEs |
before 45.5.1-1.1 | 45.5.1-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1553 is a high vulnerability (CVSS 10.0) in Mozilla Firefox, published September 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.72%, the 93rd percentile. Fixed in firefox 32.0+build1-0ubuntu0.14.04.1.
References
lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
bugzilla.mozilla.org/show_bug.cgi?id=1022945
securityfocus.com/bid/69524
Show 194 moreShow less
security.gentoo.org/glsa/201504-01
oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
securitytracker.com/id/1030794
mozilla.org/security/announce/2014/mfsa2014-67.html
secunia.com/advisories/60148
nvd.nist.gov/vuln/detail/CVE-2014-1553
github.com/advisories/GHSA-rvvr-h4rh-2hm5
advisories.mageia.org/MGASA-2014-0419.html
bugs.mageia.org/show_bug.cgi?id=14318
ubuntu.com/security/CVE-2014-1553
cve.org/CVERecord?id=CVE-2014-1553
suse.com/security/cve/CVE-2008-5913
Left out here: 1,940 references and the rest of 1 source description. The JSON record has them.