What is the CVSS score of CVE-2014-1564?

CVE-2014-1564 has a CVSS 2.0 base score of 4.3 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 13.9%.

Is there a public PoC exploit available for CVE-2014-1564?

Yes, a public proof-of-concept exploit is available for CVE-2014-1564. Prioritise patching immediately. EPSS: 13.9%.

Evergreen CVE-2014-1564

MEDIUM

Access of Uninitialized Pointer (CWE-824)

2014-09-03 security@mozilla.org

Memory Corruption Mozilla Information Disclosure Evergreen Opensuse Firefox Thunderbird

4.3

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:M/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Sep 03, 2014 - 10:55 cve.org

MEDIUM 4.3

DescriptionCVE.org

Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.

AnalysisAI

Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 13.9%.

Technical ContextAI

This vulnerability is classified under CWE-824. Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image. Affected products include: Opensuse Evergreen, Opensuse, Mozilla Firefox, Mozilla Thunderbird. Version information: before 32.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.