Mozilla

Mozilla Foundation Security Advisory 2014-37

Out of bounds read while decoding JPG images

Announced
April 29, 2014
Reporter
Abhishek Arya
Impact
Moderate
Products
Firefox, Firefox ESR, SeaMonkey, Thunderbird
Fixed in
  • Firefox 29
  • Firefox ESR 24.5
  • SeaMonkey 2.26
  • Thunderbird 24.5

Description

Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover a fixed offset out of bounds read issue while decoding specifically formatted JPG format images. This causes a non-exploitable crash.

References