CVE-2014-1590

Mozilla: XMLHttpRequest crashes with some input streams (MFSA 2014-85)

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The XMLHttpRequest.prototype.send method in Mozilla Firefox before 34.0, Firefox ESR 31.x before 31.3, Thunderbird before 31.3, and SeaMonkey before 2.31 allows remote attackers to cause a denial of service (application crash) via a crafted JavaScript object.

El método de enviar prototipo XMLHttpRequest.en Mozilla Firefox anterior a 34.0, Firefox ESR 31.x anterior a 31.3, Thunderbird anterior a 31.3, y SeaMonkey anterior a 2.31 permite a atacantes remotos causar una denegación de servicio (caída de la aplicación) a través de un objeto JavaScript manipulado.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-01-16 CVE Reserved
2014-12-02 CVE Published
2024-07-23 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (11)

URL	Tag	Source
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html	X_refsource_confirm
http://www.securityfocus.com/bid/71397	Vdb Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1087633	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html	2016-12-24
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html	2016-12-24
http://www.debian.org/security/2014/dsa-3090	2016-12-24
http://www.debian.org/security/2014/dsa-3092	2016-12-24
http://www.mozilla.org/security/announce/2014/mfsa2014-85.html	2016-12-24
https://security.gentoo.org/glsa/201504-01	2016-12-24
https://access.redhat.com/security/cve/CVE-2014-1590	2014-12-02
https://bugzilla.redhat.com/show_bug.cgi?id=1169206	2014-12-02

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mozilla Search vendor "Mozilla"		Firefox Search vendor "Mozilla" for product "Firefox"				<= 33.0 Search vendor "Mozilla" for product "Firefox" and version " <= 33.0"		-		Affected
Mozilla Search vendor "Mozilla"		Firefox Esr Search vendor "Mozilla" for product "Firefox Esr"				<= 31.2 Search vendor "Mozilla" for product "Firefox Esr" and version " <= 31.2"		-		Affected
Mozilla Search vendor "Mozilla"		Seamonkey Search vendor "Mozilla" for product "Seamonkey"				<= 2.30 Search vendor "Mozilla" for product "Seamonkey" and version " <= 2.30"		-		Affected
Mozilla Search vendor "Mozilla"		Thunderbird Search vendor "Mozilla" for product "Thunderbird"				<= 31.2 Search vendor "Mozilla" for product "Thunderbird" and version " <= 31.2"		-		Affected