CVE-2014-1479 The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operation...
HighCVSS 7.5
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | < 27.0 | 27.0 |
| mozilla Firefox | >= 24.0, < 24.3 | 24.3 |
| mozilla seamonkey | < 2.24 | 2.24 |
| mozilla Thunderbird | < 24.3 | 24.3 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.10 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux eus | = 6.5 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server aus | = 6.5 | No fix listed |
| redhat enterprise linux server eus | = 6.5 | No fix listed |
| redhat enterprise linux server tus | = 6.5 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| fedoraproject fedora | = 19 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| suse linux enterprise software development kit | = 11.0-sp3 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| suse linux enterprise desktop | = 11-sp3 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| suse linux enterprise server | = 11-sp3 | No fix listed |
References
- download.novell.com broken-link
- download.novell.com broken-link
- FEDORA-2014-2041 mailing-list third-party-advisory vendor-advisory
- FEDORA-2014-2083 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0212 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0213 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2014:0248 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0419 mailing-list third-party-advisory vendor-advisory
- 102866 broken-link vdb-entry
- RHSA-2014:0132 third-party-advisory vendor-advisory
- RHSA-2014:0133 third-party-advisory vendor-advisory
- 56706 broken-link third-party-advisory
- 56761 broken-link third-party-advisory
- 56763 broken-link third-party-advisory
- 56767 broken-link third-party-advisory
- 56787 broken-link third-party-advisory
- 56858 broken-link third-party-advisory
- 56888 broken-link third-party-advisory
- 56922 broken-link third-party-advisory
- DSA-2858 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com third-party-advisory
- 65320 third-party-advisory vdb-entry
- 1029717 third-party-advisory vdb-entry
- 1029720 third-party-advisory vdb-entry
- 1029721 third-party-advisory vdb-entry
- USN-2102-1 third-party-advisory vendor-advisory
- USN-2102-2 third-party-advisory vendor-advisory
- USN-2119-1 third-party-advisory vendor-advisory
- 8pecxstudios.com broken-link url-repurposed
- bugzilla.mozilla.org exploit issue-tracking vendor-advisory
- firefox-cve20141479-sec-bypass(90898) third-party-advisory vdb-entry
- GLSA-201504-01 third-party-advisory vendor-advisory