CVE-2014-1510

🔴 Łataj teraz

Wykonanie dowolnego kodu JavaScript z uprawnieniami chrome w Firefoxie przez zdalnego atakującego.

CVSS

9.8

EPSS

71.1%

Exploit

poc

Vendor

redhat

Opis źródłowy (NVD)

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.

exploit Brak patcha

Źródła i daty

Źródło	Wartość
NVD – CVSS	9.8
CISA KEV (aktywnie wykorzystywane)	Nie
FIRST EPSS (prawdopodobieństwo exploita)	71.1%
Opublikowano (NVD)	2014-03-19 10:55:06 UTC
Ostatnia modyfikacja (NVD)	2026-05-06 22:30:45 UTC

Referencje

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html (security@mozilla.org) [Mailing List, Third Party Advisory]
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html (security@mozilla.org) [Mailing List, Third Party Advisory]
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html (security@mozilla.org) [Mailing List, Third Party Advisory]
http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.html (security@mozilla.org) [Mailing List, Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2014-0310.html (security@mozilla.org) [Third Party Advisory]
http://rhn.redhat.com/errata/RHSA-2014-0316.html (security@mozilla.org) [Third Party Advisory]
http://www.debian.org/security/2014/dsa-2881 (security@mozilla.org) [Third Party Advisory]
http://www.debian.org/security/2014/dsa-2911 (security@mozilla.org) [Third Party Advisory]
http://www.mozilla.org/security/announce/2014/mfsa2014-29.html (security@mozilla.org) [Vendor Advisory]
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html (security@mozilla.org) [Third Party Advisory]
http://www.securityfocus.com/bid/66206 (security@mozilla.org) [Third Party Advisory, VDB Entry]
http://www.ubuntu.com/usn/USN-2151-1 (security@mozilla.org) [Third Party Advisory]
https://bugzilla.mozilla.org/show_bug.cgi?id=982906 (security@mozilla.org) [Exploit, Issue Tracking, Vendor Advisory]
https://security.gentoo.org/glsa/201504-01 (security@mozilla.org) [Third Party Advisory]