high7.5
CVE-2014-1481
Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restric…
Impact
Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 27.0 from 24.0 before 24.3 |
| Mozilla | Seamonkey | before 2.24 |
| Mozilla | Thunderbird | before 24.3 |
| Fedoraproject | Fedora | Versions 19, 20 |
| Suse | Suse Linux Enterprise Software Development Kit | Version 11.0 |
| Opensuse | Opensuse | Versions 11.4, 12.3, 13.1 |
| Suse | Suse Linux Enterprise Desktop | Version 11 |
| Suse | Suse Linux Enterprise Server | Version 11 |
| Redhat | Enterprise Linux Desktop | Versions 5.0, 6.0 |
| Redhat | Enterprise Linux Eus | Version 6.5 |
| Redhat | Enterprise Linux Server | Versions 5.0, 6.0 |
| Redhat | Enterprise Linux Server Aus | Version 6.5 |
References
- NVD record
- CVE.org record
- http://download.novell.com/Download?buildid=VYQsgaFpQ2k
- http://download.novell.com/Download?buildid=Y2fux-JW1Qc
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
- http://osvdb.org/102863
- http://rhn.redhat.com/errata/RHSA-2014-0132.html
- http://rhn.redhat.com/errata/RHSA-2014-0133.html
- http://secunia.com/advisories/56706
- http://secunia.com/advisories/56761
- http://secunia.com/advisories/56763
- http://secunia.com/advisories/56767
- http://secunia.com/advisories/56787
- http://secunia.com/advisories/56858
- http://secunia.com/advisories/56888
- http://secunia.com/advisories/56922
- http://www.debian.org/security/2014/dsa-2858
- http://www.mozilla.org/security/announce/2014/mfsa2014-13.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securityfocus.com/bid/65326
- http://www.securitytracker.com/id/1029717
- http://www.securitytracker.com/id/1029720