VIR Vulnerability Intelligence Relay

CVE-2014-1541

critical
Published 2014-06-11 · Modified 2026-05-06
CVSS v3
—
CVSS v2
10.0
VIR risk
10.0

Description

Use-after-free vulnerability in the RefreshDriverTimer::TickDriver function in the SMIL Animation Controller in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird before 24.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted web content.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security@mozilla.org — http://www.mozilla.org/security/announce/2014/mfsa2014-52.html

Application impact
VendorProductVersionsFixed
mozillathunderbird{"endIncluding":"24.5"}
mozillathunderbird24.0
mozillathunderbird24.0.1
mozillathunderbird24.1
mozillathunderbird24.1.1
mozillathunderbird24.2
mozillathunderbird24.3
mozillathunderbird24.4
mozillafirefox{"endIncluding":"29.0.1"}
mozillafirefox24.0
mozillafirefox24.0.1
mozillafirefox24.0.2
mozillafirefox24.1.0
mozillafirefox24.1.1
mozillafirefox_esr24.2
mozillafirefox_esr24.3
mozillafirefox_esr24.4
mozillafirefox_esr24.5

References

Verify integrity in audit chain (admin only). AS-IS.