PublicDateAtUSN: 2014-02-04
Candidate: CVE-2014-1482
PublicDate: 2014-02-06 05:44:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1482
 https://rhn.redhat.com/errata/RHSA-2014-0132.html
 http://www.mozilla.org/security/announce/2014/mfsa2014-04.html
 https://ubuntu.com/security/notices/USN-2102-1
 https://ubuntu.com/security/notices/USN-2119-1
Description:
 RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before
 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent
 access to discarded data, which allows remote attackers to execute
 arbitrary code or cause a denial of service (incorrect write operations)
 via crafted image data, as demonstrated by Goo Create.
Ubuntu-Description:
Notes:
Bugs:
Priority: medium
Discovered-by:
Assigned-to: chrisccoulson
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [8.8 HIGH]

Patches_firefox:
upstream_firefox: released (27.0)
lucid_firefox: ignored (reached end-of-life)
precise_firefox: released (27.0+build1-0ubuntu0.12.04.1)
quantal_firefox: released (27.0+build1-0ubuntu0.12.10.1)
saucy_firefox: released (27.0+build1-0ubuntu0.13.10.1)
devel_firefox: not-affected

Patches_thunderbird:
Priority_thunderbird: low
upstream_thunderbird: released (24.3.0)
lucid_thunderbird: ignored (reached end-of-life)
precise_thunderbird: released (1:24.3.0+build2-0ubuntu0.12.04.1)
quantal_thunderbird: released (1:24.3.0+build2-0ubuntu0.12.10.1)
saucy_thunderbird: released (1:24.3.0+build2-0ubuntu0.13.10.1)
devel_thunderbird: released (1:24.4.0+build1-0ubuntu1)