CVE-2014-1561

Ubuntu Security Notice USN-2295-1

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.

Mozilla Firefox anterior a 31.0 no restringe debidamente el uso de eventos de arrastrar y soltar para falsificar eventos de personalización, lo que permite a atacantes remotos alterar la colocación de iconos de la interfaz del usuario a través de código JavaScript manipulado que se encuentra durante la personalización de (1) páginas, (2) paneles o (3) barras de herramientas.

Multiple memory safety issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. Various other issues were also addressed.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-01-16 CVE Reserved
2014-07-22 CVE Published
2024-08-06 CVE Updated
2024-12-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-264: Permissions, Privileges, and Access Controls

CAPEC

References (8)

URL	Tag	Source
http://secunia.com/advisories/59760	Third Party Advisory
http://secunia.com/advisories/60628	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
http://www.securitytracker.com/id/1030619	Vdb Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1000514	Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=910375	Issue Tracking

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://www.mozilla.org/security/announce/2014/mfsa2014-60.html	2017-01-07
https://security.gentoo.org/glsa/201504-01	2017-01-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				<= 30.0 Search vendor "Mozilla" for product "Firefox" and version " <= 30.0"		-		Affected
Oracle Search vendor "Oracle"		Solaris Search vendor "Oracle" for product "Solaris"				11.3 Search vendor "Oracle" for product "Solaris" and version "11.3"		-		Affected