Vulnerability Description
The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and render content in a different domain via unspecified vectors.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Opensuse | 13.1 |
| Opensuse Project | Opensuse | 11.4 |
| Suse | Linux Enterprise Desktop | 11 |
| Suse | Linux Enterprise Server | 11 |
| Suse | Linux Enterprise Software Development Kit | 11 |
| Oracle | Solaris | 11.3 |
| Mozilla | Firefox | < 28.0 |
| Mozilla | Seamonkey | < 2.25 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.htmlMailing ListThird Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-22.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlMailing ListThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=972622Issue TrackingVendor Advisory
- https://security.gentoo.org/glsa/201504-01Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.htmlMailing ListThird Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-22.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlMailing ListThird Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=972622Issue TrackingVendor Advisory
FAQ
What is CVE-2014-1502?
CVE-2014-1502 is a vulnerability with a CVSS score of 6.8 (MEDIUM). The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and ...
How severe is CVE-2014-1502?
CVE-2014-1502 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-1502?
Check the references section above for vendor advisories and patch information. Affected products include: Opensuse Opensuse, Opensuse Project Opensuse, Suse Linux Enterprise Desktop, Suse Linux Enterprise Server, Suse Linux Enterprise Software Development Kit.