CVE-2014-1482— 多款Mozilla产品‘RasterImage.cpp’文件权限许可和访问控制问题漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

n/a n/a

利用判断

利用概率较高，应尽快评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Mozilla Firefox、SeaMonkey和Thunderbird都是由美国Mozilla基金会开发。Firefox是一款开源Web浏览器。SeaMonkey是一套免费、开源以及跨平台的网络套装软件。Thunderbird是从Mozilla Application Suite中独立出来的一套电子邮件客户端软件。 多款Mozilla产品中的RasterImage.cpp文件中存在安全漏洞，该漏洞源于当程序解码图像时，未限制对废弃数据的访问。远程攻击者可借助特制的图像数据利用该漏洞执行任意代码或造成拒

CVE-2014-1482 影响 n/a n/a。利用概率较高，应尽快评估。Mozilla Firefox、SeaMonkey和Thunderbird都是由美国Mozilla基金会开发。Firefox是一款开源Web浏览器。SeaMonkey是一套免费、开源以及跨平台的网络套装软件。Thunderbird是从Mozilla Application Suite中独立出来的一套电子邮件客户端软件。 多款Mozilla产品中的Raster CVE-2014-1482 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2014-1482

一、 漏洞 CVE-2014-1482 基础信息

受影响产品

二、漏洞 CVE-2014-1482 的公开POC

三、漏洞 CVE-2014-1482 的情报信息

CVE-2014-1482 厂商安全公告 (23)

• http://www.mozilla.org/security/announce/2014/mfsa2014-04.html x_refsource_CONFIRM
• https://bugzilla.mozilla.org/show_bug.cgi?id=943803 x_refsource_CONFIRM
• http://secunia.com/advisories/56763 third-party-advisory x_refsource_SECUNIA
• http://www.securityfocus.com/bid/65328 vdb-entry x_refsource_BID
• http://secunia.com/advisories/56922 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/56888 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/56767 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/56858 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/56787 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/56761 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/56706 third-party-advisory x_refsource_SECUNIA
• http://osvdb.org/102868 vdb-entry x_refsource_OSVDB
• http://www.securitytracker.com/id/1029721 vdb-entry x_refsource_SECTRACK
• http://www.securitytracker.com/id/1029720 vdb-entry x_refsource_SECTRACK
• http://www.securitytracker.com/id/1029717 vdb-entry x_refsource_SECTRACK
• http://www.debian.org/security/2014/dsa-2858 vendor-advisory x_refsource_DEBIAN
• http://www.ubuntu.com/usn/USN-2102-2 vendor-advisory x_refsource_UBUNTU
• http://www.ubuntu.com/usn/USN-2102-1 vendor-advisory x_refsource_UBUNTU
• http://www.ubuntu.com/usn/USN-2119-1 vendor-advisory x_refsource_UBUNTU
• http://rhn.redhat.com/errata/RHSA-2014-0133.html vendor-advisory x_refsource_REDHAT
• http://rhn.redhat.com/errata/RHSA-2014-0132.html vendor-advisory x_refsource_REDHAT
• https://security.gentoo.org/glsa/201504-01 vendor-advisory x_refsource_GENTOO
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90894 vdb-entry x_refsource_XF

CVE-2014-1482 邮件列表归档 (6)

• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html vendor-advisory x_refsource_FEDORA
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html vendor-advisory x_refsource_FEDORA
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html vendor-advisory x_refsource_SUSE

CVE-2014-1482 其他参考 (4)

• http://download.novell.com/Download?buildid=VYQsgaFpQ2k x_refsource_CONFIRM
• http://download.novell.com/Download?buildid=Y2fux-JW1Qc x_refsource_CONFIRM
• https://8pecxstudios.com/?page_id=44080 x_refsource_CONFIRM
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2014-1482

同批安全公告 · n/a · 2014-02-06 · 共 48 条

显示前 20 条，共 48 条。 查看全部 → →

IV. Related Vulnerabilities

V. Comments for CVE-2014-1482