---
title: "CVE-2014-1524\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2014-1524?format=md
keywords: index, follow
---

# CVE-2014-1524

Publication date 29 April 2014

Last updated 25 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**9.8 · Critical**

[Score breakdown](https://ubuntu.com/security/CVE-2014-1524?format=md#impact-score)

Toggle side navigation

## Description

The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox
before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and
SeaMonkey before 2.26 does not properly check whether objects are XBL
objects, which allows remote attackers to execute arbitrary code or cause a
denial of service (buffer overflow) via crafted JavaScript code that
accesses a non-XBL object as if it were an XBL object.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| firefox | 14.04 LTS trusty | Fixed 29.0+build1-0ubuntu0.14.04.2 |
| 13.10 saucy | Fixed 29.0+build1-0ubuntu0.13.10.3 |
| 12.10 quantal | Fixed 29.0+build1-0ubuntu0.12.10.3 |
| 12.04 LTS precise | Fixed 29.0+build1-0ubuntu0.12.04.2 |
| 10.04 LTS lucid | Ignored end of life |
| thunderbird | 14.04 LTS trusty | Fixed 1:24.5.0+build1-0ubuntu0.14.04.1 |
| 13.10 saucy | Fixed 1:24.5.0+build1-0ubuntu0.13.10.1 |
| 12.10 quantal | Fixed 1:24.5.0+build1-0ubuntu0.12.10.1 |
| 12.04 LTS precise | Fixed 1:24.5.0+build1-0ubuntu0.12.04.1 |
| 10.04 LTS lucid | Ignored end of life |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

9.8 · Critical

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | None |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | High |
  | Integrity impact | High |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 9.8 · Critical |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1524)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-1524)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2014-1524)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2014-1524)

### Related Ubuntu Security Notices (USN)

+ [USN-2185-1](https://usn.ubuntu.com/USN-2185-1)
+ Firefox vulnerabilities
+ 29 April 2014

+ [USN-2189-1](https://usn.ubuntu.com/USN-2189-1)
+ Thunderbird vulnerabilities
+ 30 April 2014

### Other references

* <http://www.mozilla.org/security/announce/2014/mfsa2014-38.html>
* <https://www.cve.org/CVERecord?id=CVE-2014-1524>