GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
usn-2458-1
Vulnerability from osv_ubuntu
Published
2015-01-14 21:27
Modified
2026-04-22 07:36
Summary
firefox vulnerabilities
Details

Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse Ruderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8634, CVE-2014-8635)

Bobby Holley discovered that some DOM objects with certain properties can bypass XrayWrappers in some circumstances. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to bypass security restrictions. (CVE-2014-8636)

Michal Zalewski discovered a use of uninitialized memory when rendering malformed bitmap images on a canvas element. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to steal confidential information. (CVE-2014-8637)

Muneaki Nishimura discovered that requests from navigator.sendBeacon() lack an origin header. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to conduct cross-site request forgery (XSRF) attacks. (CVE-2014-8638)

Xiaofeng Zheng discovered that a web proxy returning a 407 response could inject cookies in to the originally requested domain. If a user connected to a malicious web proxy, an attacker could potentially exploit this to conduct session-fixation attacks. (CVE-2014-8639)

Holger Fuhrmannek discovered a crash in Web Audio while manipulating timelines. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service. (CVE-2014-8640)

Mitchell Harper discovered a use-after-free in WebRTC. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit this to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2014-8641)

Brian Smith discovered that OCSP responses would fail to verify if signed by a delegated OCSP responder certificate with the id-pkix-ocsp-nocheck extension, potentially allowing a user to connect to a site with a revoked certificate. (CVE-2014-8642)

References
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2014-8634",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-8635",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-8636",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-8637",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-8638",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-8639",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-8640",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-8641",
              "severity": [
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2014-8642",
              "severity": [
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "firefox",
            "binary_version": "35.0+build3-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "firefox-globalmenu",
            "binary_version": "35.0+build3-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "firefox-mozsymbols",
            "binary_version": "35.0+build3-0ubuntu0.14.04.2"
          },
          {
            "binary_name": "firefox-testsuite",
            "binary_version": "35.0+build3-0ubuntu0.14.04.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:14.04:LTS",
        "name": "firefox",
        "purl": "pkg:deb/ubuntu/firefox@35.0+build3-0ubuntu0.14.04.2?arch=source\u0026distro=trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "35.0+build3-0ubuntu0.14.04.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "24.0+build1-0ubuntu1",
        "25.0+build3-0ubuntu0.13.10.1",
        "28.0~b2+build1-0ubuntu2",
        "28.0+build1-0ubuntu1",
        "28.0+build2-0ubuntu1",
        "28.0+build2-0ubuntu2",
        "29.0+build1-0ubuntu0.14.04.2",
        "30.0+build1-0ubuntu0.14.04.3",
        "31.0+build1-0ubuntu0.14.04.1",
        "32.0+build1-0ubuntu0.14.04.1",
        "32.0.3+build1-0ubuntu0.14.04.1",
        "33.0+build2-0ubuntu0.14.04.1",
        "34.0+build2-0ubuntu0.14.04.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Christian Holler, Patrick McManus, Christoph Diehl, Gary Kwong, Jesse\nRuderman, Byron Campen, Terrence Cole, and Nils Ohlmeier discovered\nmultiple memory safety issues in Firefox. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially exploit\nthese to cause a denial of service via application crash, or execute\narbitrary code with the privileges of the user invoking Firefox.\n(CVE-2014-8634, CVE-2014-8635)\n\nBobby Holley discovered that some DOM objects with certain properties\ncan bypass XrayWrappers in some circumstances. If a user were tricked in\nto opening a specially crafted website, an attacker could potentially\nexploit this to bypass security restrictions. (CVE-2014-8636)\n\nMichal Zalewski discovered a use of uninitialized memory when rendering\nmalformed bitmap images on a canvas element. If a user were tricked in to\nopening a specially crafted website, an attacker could potentially\nexploit this to steal confidential information. (CVE-2014-8637)\n\nMuneaki Nishimura discovered that requests from navigator.sendBeacon()\nlack an origin header. If a user were tricked in to opening a specially\ncrafted website, an attacker could potentially exploit this to conduct\ncross-site request forgery (XSRF) attacks. (CVE-2014-8638)\n\nXiaofeng Zheng discovered that a web proxy returning a 407 response\ncould inject cookies in to the originally requested domain. If a user\nconnected to a malicious web proxy, an attacker could potentially exploit\nthis to conduct session-fixation attacks. (CVE-2014-8639)\n\nHolger Fuhrmannek discovered a crash in Web Audio while manipulating\ntimelines. If a user were tricked in to opening a specially crafted\nwebsite, an attacker could potentially exploit this to cause a denial\nof service. (CVE-2014-8640)\n\nMitchell Harper discovered a use-after-free in WebRTC. If a user were\ntricked in to opening a specially crafted website, an attacker could\npotentially exploit this to cause a denial of service via application\ncrash, or execute arbitrary code with the privileges of the user invoking\nFirefox. (CVE-2014-8641)\n\nBrian Smith discovered that OCSP responses would fail to verify if signed\nby a delegated OCSP responder certificate with the id-pkix-ocsp-nocheck\nextension, potentially allowing a user to connect to a site with a revoked\ncertificate. (CVE-2014-8642)\n",
  "id": "USN-2458-1",
  "modified": "2026-04-22T07:36:32Z",
  "published": "2015-01-14T21:27:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-2458-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8634"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8635"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8636"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8637"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8638"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8639"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8640"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8641"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2014-8642"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "firefox vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2014-8634",
    "UBUNTU-CVE-2014-8635",
    "UBUNTU-CVE-2014-8636",
    "UBUNTU-CVE-2014-8637",
    "UBUNTU-CVE-2014-8638",
    "UBUNTU-CVE-2014-8639",
    "UBUNTU-CVE-2014-8640",
    "UBUNTU-CVE-2014-8641",
    "UBUNTU-CVE-2014-8642"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.