CVE-2014-1486

Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.

Published: Feb 6, 2014
Updated: Nov 9, 2025
CVE: CVE-2014-1486
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 10
AV:N/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-416

Affected Software
References

Software	From	Fixed in
mozilla / seamonkey	-	2.24
mozilla / firefox	-	27.0
mozilla / thunderbird	-	24.3
fedoraproject / fedora	20	20.x
fedoraproject / fedora	19	19.x
opensuse / opensuse	12.3	12.3.x
suse / suse_linux_enterprise_software_development_kit	11.0-sp3	11.0-sp3.x
opensuse / opensuse	11.4	11.4.x
opensuse / opensuse	13.1	13.1.x
suse / suse_linux_enterprise_desktop	11-sp3	11-sp3.x
suse / suse_linux_enterprise_server	11-sp3	11-sp3.x
debian / debian_linux	7.0	7.0.x
canonical / ubuntu_linux	13.10	13.10.x
canonical / ubuntu_linux	12.10	12.10.x
canonical / ubuntu_linux	12.04	12.04.x
redhat / enterprise_linux_server_aus	6.5	6.5.x
redhat / enterprise_linux_server_tus	6.5	6.5.x
redhat / enterprise_linux_desktop	6.0	6.0.x
redhat / enterprise_linux_server	6.0	6.0.x
redhat / enterprise_linux_workstation	6.0	6.0.x
redhat / enterprise_linux_eus	6.5	6.5.x
mozilla / firefox	24.0	24.3

Vulnerability Database

310,450

CVE-2014-1486

Deep Security Visibility Without the Complexity