Lucene search
Mozilla FoundationMFSA2014-82HistoryOct 14, 2014 - 12:00 a.m.
Accessing cross-origin objects via the Alarms API — Mozilla
2014-10-1400:00:00
Mozilla Foundation
www.mozilla.org
28
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS
0.007
Percentile
80.5%
Mozilla developer Boris Zbarsky reported that a malicious app could use the AlarmAPI to read the values of cross-origin references, such as an iframe’s location object, as part of an alarm’s JSON data. This allows a malicious app to bypass same-origin policy.
Affected configurations
Node
mozillafirefoxRange<33
ORmozillafirefox_esrRange<31.2
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mozilla | firefox | * | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | firefox_esr | * | cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
Related
nvd
nvd
CVE-2014-1583
2014-10-15 10:55:06
openvas
openvas
Mozilla Firefox Security Advisory (MFSA2014-82) - Linux
2021-11-11 00:00:00
CentOS Update for firefox CESA-2014:1635 centos7
2014-10-16 00:00:00
Oracle: Security Advisory (ELSA-2014-1635)
2015-10-06 00:00:00
cvelist
cvelist
CVE-2014-1583
2014-10-15 10:00:00
prion
prion
Design/Logic Flaw
2014-10-15 10:55:00
ubuntucve
ubuntucve
CVE-2014-1583
2014-10-14 00:00:00
cve
cve
CVE-2014-1583
2014-10-15 10:55:06
oraclelinux
oraclelinux
firefox security update
2014-10-15 00:00:00
veracode
veracode
Out-Of-Bounds Write
2019-05-02 05:12:55
Same Origin Policy Bypass
2019-05-02 05:12:56
Out-Of-Bounds Read
2019-05-02 05:12:55
nessus
nessus
CentOS 5 / 6 / 7 : firefox (CESA-2014:1635)
2014-10-16 00:00:00
RHEL 5 / 6 / 7 : firefox (RHSA-2014:1635)
2014-10-15 00:00:00
Oracle Linux 5 / 6 / 7 : firefox (ELSA-2014-1635)
2014-10-16 00:00:00
centos
centos
firefox, xulrunner security update
2014-10-15 12:07:15
redhat
redhat
(RHSA-2014:1635) Critical: firefox security update
2014-10-14 00:00:00
mageia
mageia
Updated firefox and thunderbird packages fix security vulnerabilities
2014-10-26 00:23:09
Updated iceape package fixes security vulnerabilities
2014-10-23 17:27:57
debian
debian
[SECURITY] [DSA 3050-3] iceweasel security update
2014-11-12 20:46:04
[SECURITY] [DSA 3050-3] iceweasel security update
2014-11-12 20:46:04
[SECURITY] [DSA 3050-1] iceweasel security update
2014-10-18 17:31:55
osv
osv
iceweasel - security update
2014-10-15 00:00:00
MozillaFirefox-50.1.0-1.1 on GA media
2024-06-15 00:00:00
suse
suse
Security update for MozillaFirefox (important)
2014-11-11 00:04:48
Security update for MozillaFirefox (important)
2014-11-21 19:05:03
Security update for MozillaFirefox (important)
2014-11-24 19:05:36
freebsd
freebsd
mozilla -- multiple vulnerabilities
2014-10-14 00:00:00
ubuntu
ubuntu
Firefox vulnerabilities
2014-10-14 00:00:00
securityvulns
securityvulns
Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities
2014-10-15 00:00:00
ibm
ibm
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2015-04-07 00:00:00
CVSS2
5
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS
0.007
Percentile
80.5%
Related for MFSA2014-82