CVE-2014-1555: Mozilla Firefox

High severity, CVSS 9.3. EPSS: 4.9% chance of exploitation in the next 30 days.

Use-after-free vulnerability in the nsDocLoader::OnProgress function in Mozilla Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7 allows remote attackers to execute arbitrary code via vectors that trigger a FireOnStateChange event.

Affected products

• Mozilla Firefox: up to and including 30.0; version 24.0 only; version 24.0.1 only; version 24.0.2 only; version 24.1.0 only; version 24.1.1 only
• Mozilla Firefox ESR: version 24.2 only; version 24.3 only; version 24.4 only; version 24.5 only; version 24.6 only
• Mozilla Thunderbird: up to and including 24.6; version 24.0 only; version 24.0.1 only; version 24.1 only; version 24.1.1 only; version 24.2 only; …

Published 2014-07-23. Last modified 2026-06-17.