CVE-2014-1564

Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 do not properly initialize memory for GIF rendering, which allows remote attackers to obtain sensitive information from process memory via crafted web script that interacts with a CANVAS element associated with a malformed GIF image.

• CWE-824

• http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.htmlThird Party Advisory
• http://packetstormsecurity.com/files/128132/Mozilla-Firefox-Secret-Leak.html
• http://seclists.org/fulldisclosure/2014/Sep/18
• http://secunia.com/advisories/60148
• http://secunia.com/advisories/61114
• http://www.mozilla.org/security/announce/2014/mfsa2014-69.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.securityfocus.com/archive/1/533357/100/0/threaded
• http://www.securityfocus.com/bid/69525
• http://www.securitytracker.com/id/1030793
• http://www.securitytracker.com/id/1030794
• https://bugzilla.mozilla.org/show_bug.cgi?id=1045977Issue Tracking
• https://security.gentoo.org/glsa/201504-01
• http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00003.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.htmlThird Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00011.htmlThird Party Advisory
• http://packetstormsecurity.com/files/128132/Mozilla-Firefox-Secret-Leak.html
• http://seclists.org/fulldisclosure/2014/Sep/18
• http://secunia.com/advisories/60148
• http://secunia.com/advisories/61114
• http://www.mozilla.org/security/announce/2014/mfsa2014-69.htmlVendor Advisory
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• http://www.securityfocus.com/archive/1/533357/100/0/threaded
• http://www.securityfocus.com/bid/69525
• http://www.securitytracker.com/id/1030793
• http://www.securitytracker.com/id/1030794
• https://bugzilla.mozilla.org/show_bug.cgi?id=1045977Issue Tracking
• https://security.gentoo.org/glsa/201504-01

Published

Sep 3, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-1558Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1559Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1560Mozilla Firefox before 31.0 and Thunderbird before 31.0 allo…
• CVE-2014-1561Mozilla Firefox before 31.0 does not properly restrict use o…
• CVE-2014-1562Unspecified vulnerability in the browser engine in Mozilla F…
• CVE-2014-1563Use-after-free vulnerability in the mozilla::DOMSVGLength::G…
• CVE-2014-1565The mozilla::dom::AudioEventTimeline function in the Web Aud…
• CVE-2014-1566Mozilla Firefox before 31.1 on Android does not properly res…
• CVE-2014-1567Use-after-free vulnerability in DirectionalityUtils.cpp in M…
• CVE-2014-1568Mozilla Network Security Services (NSS) before 3.16.2.1, 3.1…
• CVE-2014-1569The definite_length_decoder function in lib/util/quickder.c …
• CVE-2014-1571Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x be…