PT-2014-1173 · Mozilla+2 · Firefox+3

Publicado 2014-03-18 · Atualizado 2024-12-12 · CVE-2014-1504

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 28.0 SeaMonkey versions prior to 2.25

Description The session-restore feature does not consider the Content Security Policy of a data: URL, making it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart. This allows remote attackers to perform cross-site scripting using a specially formed document, accessed after the browser restart.

Recommendations For Mozilla Firefox versions prior to 28.0, update to version 28.0 or later to resolve the issue. For SeaMonkey versions prior to 2.25, update to version 2.25 or later to resolve the issue. As a temporary workaround, consider disabling the session-restore feature until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2014-1407

ALT-PU-2014-1411

BDU:2014-00314

BDU:2014-00315

CVE-2014-1504

MGASA-2014-0146

OPENSUSE-SU-2014_0419-1

OPENSUSE-SU-2014_0448-1

OPENSUSE-SU-2014_0584-1

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

Produtos afetados

Alt Linux

Firefox

Seamonkey

Suse

Referências · 3108

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://suse.com/security/cve/CVE-2009-0354 · Nota