CVE-2014-1557

Status: ModifiedHigh (9.3)—
The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image.
CVSS

Version: 2.0
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Base score: 9.3
Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 4.94%
Percentile among all scored CVEs: 92
Score date: 10/8/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (5)

Debian — Debian Linux Mozilla — Firefox Mozilla — Firefox ESR Mozilla — Thunderbird Oracle — Solaris
CWEs

CWE-94
References

Raw JSON (NVD)

Show
{
  "id": "CVE-2014-1557",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-07-23T11:12:43.217",
  "references": [
    {
      "url": "http://linux.oracle.com/errata/ELSA-2014-0918.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/59591",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/59719",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/59760",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/60083",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/60306",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/60486",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/60621",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/60628",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-2986",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-2996",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-64.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/68824",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1030619",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1030620",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=913805",
      "tags": [
        "Issue Tracking"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://linux.oracle.com/errata/ELSA-2014-0918.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/59591",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/59719",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/59760",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/60083",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/60306",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/60486",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/60621",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/60628",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-2986",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-2996",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-64.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/68824",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1030619",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1030620",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=913805",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The ConvolveHorizontally function in Skia, as used in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, does not properly handle the discarding of image data during function execution, which allows remote attackers to execute arbitrary code by triggering prolonged image scaling, as demonstrated by scaling of a high-quality image."
    },
    {
      "lang": "es",
      "value": "La función ConvolveHorizontally en Skia, utilizado en Mozilla Firefox anterior a 31.0, Firefox ESR 24.x anterior a 24.7 y Thunderbird anterior a 24.7, no maneja debidamente el descarte de datos de imágenes durante la ejecución de la función, lo que permite a atacantes remotos ejecutar código arbitrario mediante la provocación del escalado prolongado de imágenes, tal y como fue demostrado mediante el escalado de un imagen de alta calidad."
    }
  ],
  "lastModified": "2026-06-17T00:05:09.380",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79A602C5-61FE-47BA-9786-F045B6C6DBA8"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3BD70C79-7EA7-49CB-B3D6-6C77E0C55BB4",
              "versionEndIncluding": "30.0"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:24.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18E772D1-DD0F-4F04-8BB4-9550F3C601E1"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:24.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B31FDE6-3EA6-4946-9A76-605F3C561C11"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:24.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46964729-D50D-4F17-A2F9-584A25E6F8DC"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:24.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "050A0328-B07A-4CC7-B42E-A034F3140032"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:24.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "732CC40B-BCBA-436B-956F-52BE28D9B79B"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox_esr:24.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A237D8D8-5656-4537-AD08-30CB8B4DAD63"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox_esr:24.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04B61AC7-E951-407F-A62E-490F9FEDE9C1"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox_esr:24.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9F70319-C8E4-4F54-9449-B0C3A59BF7C5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox_esr:24.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CAD5F3B-54D7-425B-89D2-A3A86DE31BAE"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox_esr:24.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "44D4B068-3456-4748-94BE-ACBA6A026570"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0B063ED-8BD8-4E14-8990-D23CCB0A20BB",
              "versionEndIncluding": "24.6"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CCAFDF1-10BB-4AB0-9C9D-E99DDBA901BB"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31EE89B8-705F-4A05-9015-3D6E81D394E9"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E30AE3D4-6A3E-435E-BDBF-1A9A17297433"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0C705A0-62C0-485A-A077-C7DD426F80B5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66C802A7-E4D5-4D2D-9CE8-749A75DF7461"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E8A57FA-AC27-4288-8E42-97DECF3B993C"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D474B11-98D0-41A3-A98B-CFB6955264AE"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BBD940E-9EF0-460B-A721-E70C719F2244"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "036E8A89-7A16-411F-9D31-676313BB7244"
            },
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}