Vulnerability Description
Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission prompt by triggering navigation at a certain time during generation of this prompt.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Suse | Linux Enterprise Desktop | 11 |
| Suse | Linux Enterprise Server | 11 |
| Suse | Linux Enterprise Software Development Kit | 11 |
| Mozilla | Seamonkey | < 2.25 |
| Oracle | Solaris | 11.3 |
| Mozilla | Firefox | < 28.0 |
| Opensuse | Opensuse | 13.1 |
| Opensuse Project | Opensuse | 11.4 |
References
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.htmlMailing ListThird Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-19.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=961512Issue TrackingVendor Advisory
- https://security.gentoo.org/glsa/201504-01Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.htmlMailing ListThird Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-19.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=961512Issue TrackingVendor Advisory
FAQ
What is CVE-2014-1499?
CVE-2014-1499 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission prompt by triggering navigation at a certain...
How severe is CVE-2014-1499?
CVE-2014-1499 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-1499?
Check the references section above for vendor advisories and patch information. Affected products include: Suse Linux Enterprise Desktop, Suse Linux Enterprise Server, Suse Linux Enterprise Software Development Kit, Mozilla Seamonkey, Oracle Solaris.