Mozilla

Mozilla Foundation Security Advisory 2014-54

Buffer overflow in Gamepad API

Announced
June 10, 2014
Reporter
Looben Yang
Impact
High
Products
Firefox, SeaMonkey
Fixed in
  • Firefox 30
  • SeaMonkey 2.26.1

Description

Security researcher Looben Yang reported a buffer overflow in Gamepad API when it is exercised with a gamepad device with non-contiguous axes. This can be either an actual physical device or by the installation of a virtual gamepad. This results in a potentially exploitable crash. The Gamepad API was introduced in Firefox 29 and this issue does not affect earlier versions.

This issue occurs only on Windows 8 with a gamepad or virtual gamepad attached.

References