CVE-2014-1557

The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.

• CWE-94

• http://linux.oracle.com/errata/ELSA-2014-0918.html
• http://secunia.com/advisories/59591
• http://secunia.com/advisories/59719
• http://secunia.com/advisories/59760
• http://secunia.com/advisories/60083
• http://secunia.com/advisories/60306
• http://secunia.com/advisories/60486
• http://secunia.com/advisories/60621
• http://secunia.com/advisories/60628
• http://www.debian.org/security/2014/dsa-2986Third Party Advisory
• http://www.debian.org/security/2014/dsa-2996Third Party Advisory
• http://www.mozilla.org/security/announce/2014/mfsa2014-64.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securityfocus.com/bid/68824
• http://www.securitytracker.com/id/1030619
• http://www.securitytracker.com/id/1030620
• https://bugzilla.mozilla.org/show_bug.cgi?id=913805Issue Tracking
• https://security.gentoo.org/glsa/201504-01
• http://linux.oracle.com/errata/ELSA-2014-0918.html
• http://secunia.com/advisories/59591
• http://secunia.com/advisories/59719
• http://secunia.com/advisories/59760
• http://secunia.com/advisories/60083
• http://secunia.com/advisories/60306
• http://secunia.com/advisories/60486
• http://secunia.com/advisories/60621
• http://secunia.com/advisories/60628
• http://www.debian.org/security/2014/dsa-2986Third Party Advisory
• http://www.debian.org/security/2014/dsa-2996Third Party Advisory
• http://www.mozilla.org/security/announce/2014/mfsa2014-64.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securityfocus.com/bid/68824
• http://www.securitytracker.com/id/1030619
• http://www.securitytracker.com/id/1030620
• https://bugzilla.mozilla.org/show_bug.cgi?id=913805Issue Tracking
• https://security.gentoo.org/glsa/201504-01

Published

Jul 23, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-1551Use-after-free vulnerability in the FontTableRec destructor …
• CVE-2014-1552Mozilla Firefox before 31.0 and Thunderbird before 31.0 do n…
• CVE-2014-1553Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2014-1554Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2014-1555Use-after-free vulnerability in the nsDocLoader::OnProgress …
• CVE-2014-1556Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, a…
• CVE-2014-1558Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1559Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1560Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1561Mozilla Firefox before 31.0 does not properly restrict use o…
• CVE-2014-1562Unspecified vulnerability in the browser engine in Mozilla F…
• CVE-2014-1563Use-after-free vulnerability in the mozilla::DOMSVGLength::G…