CVE-2014-1480
At a glance
- Source
- NVD
- EPSS
- EPSS 2.67 % · percentile 86 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mozilla
- NVD status
- Modified
Description
The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.
Weaknesses (CWE)
- CWE-1021 — Improper Restriction of Rendered UI Layers or Frames
References
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
- http://www.securitytracker.com/id/1029717
- http://www.mozilla.org/security/announce/2014/mfsa2014-03.html
- http://www.securitytracker.com/id/1029720
- http://www.ubuntu.com/usn/USN-2102-2
- https://security.gentoo.org/glsa/201504-01
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://secunia.com/advisories/56888
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90897
- http://osvdb.org/102867
- https://bugzilla.mozilla.org/show_bug.cgi?id=916726
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
- http://www.ubuntu.com/usn/USN-2102-1
- http://www.securityfocus.com/bid/65331
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2014-1556
- GCVE · GCVE-0-2014-1480
CERT-FR advisories
- CERTFR-2014-AVI-053 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3:*:*:*:*:*:*cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*< 27.0cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*< 2.24
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |