CVE-2014-1563

Use-after-free vulnerability in the mozilla::DOMSVGLength::GetTearOff function in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG animation with DOM interaction that triggers incorrect cycle collection.

• CWE-416

• http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.htmlThird Party Advisory
• http://secunia.com/advisories/60148
• http://secunia.com/advisories/61114
• http://www.mozilla.org/security/announce/2014/mfsa2014-68.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securityfocus.com/bid/69523
• http://www.securitytracker.com/id/1030793
• http://www.securitytracker.com/id/1030794
• https://bugzilla.mozilla.org/show_bug.cgi?id=1018524Issue Tracking
• https://security.gentoo.org/glsa/201504-01
• http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.htmlThird Party Advisory
• http://secunia.com/advisories/60148
• http://secunia.com/advisories/61114
• http://www.mozilla.org/security/announce/2014/mfsa2014-68.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
• http://www.securityfocus.com/bid/69523
• http://www.securitytracker.com/id/1030793
• http://www.securitytracker.com/id/1030794
• https://bugzilla.mozilla.org/show_bug.cgi?id=1018524Issue Tracking
• https://security.gentoo.org/glsa/201504-01

Published

Sep 3, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-1557The ConvolveHorizontally function in Skia, as used in Mozill…
• CVE-2014-1558Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1559Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1560Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1561Mozilla Firefox before 31.0 does not properly restrict use o…
• CVE-2014-1562Unspecified vulnerability in the browser engine in Mozilla F…
• CVE-2014-1564Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, a…
• CVE-2014-1565The mozilla::dom::AudioEventTimeline function in the Web Aud…
• CVE-2014-1566Mozilla Firefox before 31.1 on Android does not properly res…
• CVE-2014-1567Use-after-free vulnerability in DirectionalityUtils.cpp in M…
• CVE-2014-1568Mozilla Network Security Services (NSS) before 3.16.2.1, 3.1…
• CVE-2014-1569The definite_length_decoder function in lib/util/quickder.c …