Vulnerability Details : CVE-2014-1479
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.
Products affected by CVE-2014-1479
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
- cpe:2.3:a:suse:suse_linux_enterprise_software_development_kit:11.0:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:-:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-1479
1.24%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 85 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-1479
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
3.9
|
3.6
|
NIST |
References for CVE-2014-1479
-
http://www.debian.org/security/2014/dsa-2858
Debian -- Security Information -- DSA-2858-1 iceweaselThird Party Advisory
-
http://www.securitytracker.com/id/1029721
Mozilla Thunderbird Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
[security-announce] SUSE-SU-2014:0248-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
[security-announce] openSUSE-SU-2014:0419-1: important: Mozilla updatesMailing List;Third Party Advisory
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/90898
Mozilla Firefox,Thunderbird and SeaMonkey SOW security bypass CVE-2014-1479 Vulnerability ReportThird Party Advisory;VDB Entry
-
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Oracle Solaris Bulletin - April 2016Third Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2014-0133.html
RHSA-2014:0133 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
[security-announce] openSUSE-SU-2014:0212-1: important: Mozilla FirefoxMailing List;Third Party Advisory
-
http://www.securityfocus.com/bid/65320
Mozilla Firefox/Thunderbird/SeaMonkey CVE-2014-1479 Security Bypass VulnerabilityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1029717
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
https://security.gentoo.org/glsa/201504-01
Mozilla Products: Multiple vulnerabilities (GLSA 201504-01) — Gentoo securityThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2102-2
USN-2102-2: Firefox regression | Ubuntu security noticesThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
[SECURITY] Fedora 19 Update: thunderbird-24.3.0-1.fc19Mailing List;Third Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
[SECURITY] Fedora 20 Update: thunderbird-24.3.0-1.fc20Mailing List;Third Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=911864
911864 - (CVE-2014-1479) Using XBL scopes its possible to steal(clone) native anonymous content.Exploit;Issue Tracking;Vendor Advisory
-
http://www.ubuntu.com/usn/USN-2102-1
USN-2102-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
[security-announce] openSUSE-SU-2014:0213-1: important: Mozilla updatesMailing List;Third Party Advisory
-
http://www.securitytracker.com/id/1029720
Mozilla Seamonkey Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTrackerThird Party Advisory;VDB Entry
-
http://rhn.redhat.com/errata/RHSA-2014-0132.html
RHSA-2014:0132 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.mozilla.org/security/announce/2014/mfsa2014-02.html
Clone protected content with XBL scopes — MozillaVendor Advisory
-
http://www.ubuntu.com/usn/USN-2119-1
USN-2119-1: Thunderbird vulnerabilities | Ubuntu security noticesThird Party Advisory
Jump to