CVE-2014-1557
The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.
Key facts
- CVSS score
- 9.3 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:M/Au:N/C:C/I:C/A:C- Weakness (CWE)
- CWE-94
- EPSS score
- 4.9% (92th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2014-1633)
- Published
- July 23, 2014
- NVD last modified
- June 17, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2014-1633 in the EU Vulnerability Database. Last updated in EUVD on August 6, 2024.
View on the EU Vulnerability DatabaseAffected products
- debian / debian linux
- debian / debian linux
- mozilla / firefox
- mozilla / firefox
- mozilla / firefox
- mozilla / firefox
- mozilla / firefox
- mozilla / firefox
- mozilla / firefox esr
- mozilla / firefox esr
- mozilla / firefox esr
- mozilla / firefox esr
- mozilla / firefox esr
- mozilla / thunderbird
- mozilla / thunderbird
- mozilla / thunderbird
- mozilla / thunderbird
- mozilla / thunderbird
- mozilla / thunderbird
- mozilla / thunderbird
- mozilla / thunderbird
- mozilla / thunderbird
- oracle / solaris
References
- http://linux.oracle.com/errata/ELSA-2014-0918.html
- http://secunia.com/advisories/59591
- http://secunia.com/advisories/59719
- http://secunia.com/advisories/59760
- http://secunia.com/advisories/60083
- http://secunia.com/advisories/60306
- http://secunia.com/advisories/60486
- http://secunia.com/advisories/60621
- http://secunia.com/advisories/60628
- http://www.debian.org/security/2014/dsa-2986(Third Party Advisory)
- http://www.debian.org/security/2014/dsa-2996(Third Party Advisory)
- http://www.mozilla.org/security/announce/2014/mfsa2014-64.html(Vendor Advisory)
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html(Third Party Advisory)
- http://www.securityfocus.com/bid/68824
- http://www.securitytracker.com/id/1030619
- http://www.securitytracker.com/id/1030620
- https://bugzilla.mozilla.org/show_bug.cgi?id=913805(Issue Tracking)
- https://security.gentoo.org/glsa/201504-01
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain