high7.5
CVE-2014-1479
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 d…
Impact
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 27.0 from 24.0 before 24.3 |
| Mozilla | Seamonkey | before 2.24 |
| Mozilla | Thunderbird | before 24.3 |
| Canonical | Ubuntu Linux | Versions 12.04, 12.10, 13.10 |
| Debian | Debian Linux | Version 7.0 |
| Redhat | Enterprise Linux Desktop | Versions 5.0, 6.0 |
| Redhat | Enterprise Linux Eus | Version 6.5 |
| Redhat | Enterprise Linux Server | Versions 5.0, 6.0 |
| Redhat | Enterprise Linux Server Aus | Version 6.5 |
| Redhat | Enterprise Linux Server Eus | Version 6.5 |
| Redhat | Enterprise Linux Server Tus | Version 6.5 |
| Redhat | Enterprise Linux Workstation | Versions 5.0, 6.0 |
References
- NVD record
- CVE.org record
- http://download.novell.com/Download?buildid=VYQsgaFpQ2k
- http://download.novell.com/Download?buildid=Y2fux-JW1Qc
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
- http://osvdb.org/102866
- http://rhn.redhat.com/errata/RHSA-2014-0132.html
- http://rhn.redhat.com/errata/RHSA-2014-0133.html
- http://secunia.com/advisories/56706
- http://secunia.com/advisories/56761
- http://secunia.com/advisories/56763
- http://secunia.com/advisories/56767
- http://secunia.com/advisories/56787
- http://secunia.com/advisories/56858
- http://secunia.com/advisories/56888
- http://secunia.com/advisories/56922
- http://www.debian.org/security/2014/dsa-2858
- http://www.mozilla.org/security/announce/2014/mfsa2014-02.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/65320
- http://www.securitytracker.com/id/1029717
- http://www.securitytracker.com/id/1029720