JavaScript Code Execution Vulnerability in Mozilla Products
CVE-2014-1529

8.8HIGH

Key Information:

Vendor
Mozilla
Status
Thunderbird
Firefox
Firefox Esr
Seamonkey
Vendor
CVE Published:
30 April 2014

Summary

The Web Notification API present in Mozilla Firefox, Thunderbird, and SeaMonkey prior to the specified versions allows attackers to bypass restrictions on source components. This can lead to the execution of arbitrary JavaScript code in a privileged context, potentially enabling malicious activities on the user's system if Notification.permission is wrongly granted through a crafted web page.

References

http://rhn.redhat.com/errata/RHSA-2014-0448.html
vendor-advisoryx_refsource_REDHAT
http://lists.fedoraproject.org/pipermail/package-announce...
vendor-advisoryx_refsource_FEDORA
http://lists.opensuse.org/opensuse-updates/2014-05/msg000...
vendor-advisoryx_refsource_SUSE

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.