CVE-2014-1483

Mozilla Firefox <27.0 & SeaMonkey <2.24 - CSRF

Title source: llm
STIX 2.1

Description

Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.

References (19)

Core 19
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1029717
Broken Link, URL Repurposed x_refsource_confirm
https://8pecxstudios.com/?page_id=44080
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56787
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1029720
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=950427
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/65316
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2102-2
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201504-01
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/90893
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56888
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
Broken Link vdb-entry x_refsource_osvdb
http://osvdb.org/102869
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2102-1
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56767
Broken Link third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56706

Scores

EPSS 0.0028
EPSS Percentile 51.1%

Details

CWE
CWE-1021
Status published
Products (12)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 12.10
canonical/ubuntu_linux 13.10
mozilla/firefox < 27.0
mozilla/seamonkey < 2.24
opensuse/opensuse 11.4
opensuse/opensuse 12.3
opensuse/opensuse 13.1
oracle/solaris 11.3
suse/linux_enterprise_desktop 11 sp3
... and 2 more
Published Feb 06, 2014
Tracked Since Feb 18, 2026