Vulnerability Description
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 27.0 |
| Mozilla | Seamonkey | < 2.24 |
| Mozilla | Thunderbird | < 24.3 |
| Canonical | Ubuntu Linux | 12.04 |
| Debian | Debian Linux | 7.0 |
| Redhat | Enterprise Linux Desktop | 5.0 |
| Redhat | Enterprise Linux Eus | 6.5 |
| Redhat | Enterprise Linux Server | 5.0 |
| Redhat | Enterprise Linux Server Aus | 6.5 |
| Redhat | Enterprise Linux Server Eus | 6.5 |
| Redhat | Enterprise Linux Server Tus | 6.5 |
| Redhat | Enterprise Linux Workstation | 5.0 |
| Fedoraproject | Fedora | 19 |
| Suse | Suse Linux Enterprise Software Development Kit | 11.0 |
| Opensuse | Opensuse | 11.4 |
| Suse | Suse Linux Enterprise Desktop | 11 |
| Suse | Suse Linux Enterprise Server | 11 |
References
- http://download.novell.com/Download?buildid=VYQsgaFpQ2kBroken Link
- http://download.novell.com/Download?buildid=Y2fux-JW1QcBroken Link
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.hMailing ListThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/129218.hMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing ListThird Party Advisory
- http://osvdb.org/102866Broken Link
- http://rhn.redhat.com/errata/RHSA-2014-0132.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2014-0133.htmlThird Party Advisory
- http://secunia.com/advisories/56706Broken Link
- http://secunia.com/advisories/56761Broken Link
- http://secunia.com/advisories/56763Broken Link
- http://secunia.com/advisories/56767Broken Link
FAQ
What is CVE-2014-1479?
CVE-2014-1479 is a vulnerability with a CVSS score of 7.5 (HIGH). The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operation...
How severe is CVE-2014-1479?
CVE-2014-1479 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-1479?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Seamonkey, Mozilla Thunderbird, Canonical Ubuntu Linux, Debian Debian Linux.