CVE-2014-1487 The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy...
HighCVSS 7.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | < 27.0 | 27.0 |
| mozilla Firefox | >= 24.0, < 24.3 | 24.3 |
| mozilla seamonkey | < 2.24 | 2.24 |
| mozilla Thunderbird | < 24.3 | 24.3 |
| fedoraproject fedora | = 19 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| suse linux enterprise software development kit | = 11.0-sp3 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| suse linux enterprise desktop | = 11-sp3 | No fix listed |
| suse linux enterprise server | = 11-sp3 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.10 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux eus | = 6.5 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server aus | = 6.5 | No fix listed |
| redhat enterprise linux server eus | = 6.5 | No fix listed |
| redhat enterprise linux server tus | = 6.5 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux workstation | = 6.0 | No fix listed |
References
- download.novell.com broken-link
- download.novell.com broken-link
- FEDORA-2014-2041 mailing-list third-party-advisory vendor-advisory
- FEDORA-2014-2083 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0212 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0213 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2014:0248 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2014:0419 mailing-list third-party-advisory vendor-advisory
- 102873 broken-link vdb-entry
- RHSA-2014:0132 third-party-advisory vendor-advisory
- RHSA-2014:0133 third-party-advisory vendor-advisory
- 56706 broken-link third-party-advisory
- 56761 broken-link third-party-advisory
- 56763 broken-link third-party-advisory
- 56767 broken-link third-party-advisory
- 56787 broken-link third-party-advisory
- 56858 broken-link third-party-advisory
- 56888 broken-link third-party-advisory
- 56922 broken-link third-party-advisory
- DSA-2858 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com third-party-advisory
- 65330 third-party-advisory vdb-entry
- 1029717 third-party-advisory vdb-entry
- 1029720 third-party-advisory vdb-entry
- 1029721 third-party-advisory vdb-entry
- USN-2102-1 third-party-advisory vendor-advisory
- USN-2102-2 third-party-advisory vendor-advisory
- USN-2119-1 third-party-advisory vendor-advisory
- 8pecxstudios.com broken-link url-repurposed
- bugzilla.mozilla.org exploit issue-tracking vendor-advisory
- mozilla-cve20141487-info-disc(90889) third-party-advisory vdb-entry
- GLSA-201504-01 third-party-advisory vendor-advisory