CVE-2014-8636 The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to exec...
HighCVSS 7.5
EPSS 63.9%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to execute arbitrary JavaScript code with chrome privileges via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | <= 34.0.5 | No fix listed |
| mozilla seamonkey | <= 2.31 | No fix listed |
References
- openSUSE-SU-2015:0077 vendor-advisory
- SUSE-SU-2015:0171 vendor-advisory
- SUSE-SU-2015:0173 vendor-advisory
- SUSE-SU-2015:0180 vendor-advisory
- openSUSE-SU-2015:0192 vendor-advisory
- packetstormsecurity.com
- 62242 third-party-advisory
- 62250 third-party-advisory
- 62418 third-party-advisory
- 62446 third-party-advisory
- 62790 third-party-advisory
- www.mozilla.org vendor-advisory
- www.oracle.com
- 72041 vdb-entry
- 1031533 vdb-entry
- bugzilla.mozilla.org
- community.rapid7.com
- firefox-cve20148636-sec-bypass(99964) vdb-entry
- GLSA-201504-01 vendor-advisory