CVE-2014-1529 — Improper Privilege Management in Mozilla Firefox

CWE-269 — Improper Privilege Management8 documents7 sources
Severity
8.8HIGHNVD
EPSS
1.3%
top 20.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird+12 more
Timeline
PublishedApr 30
Latest updateMay 13

Description

The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages10 packages

▶NVDmozilla/firefox24.0 — 24.5+1
▶Ubuntumozilla/firefox< 29.0+build1-0ubuntu0.14.04.2
▶NVDmozilla/seamonkey< 2.26
▶Ubuntumozilla/thunderbird< 1:24.5.0+build1-0ubuntu0.14.04.1

Also affects: Debian Linux 7.0, 8.0, Fedora 19, 20, Ubuntu Linux 12.04, 12.10, 13.10, 14.04, Enterprise Linux 6.5

🔴Vulnerability Details

3
GHSA
GHSA-vcpc-r52j-cpgq: The Web Notification API in Mozilla Firefox before 29↗2022-05-13
▶
CVEList
CVE-2014-1529: The Web Notification API in Mozilla Firefox before 29↗2014-04-30
▶
OSV
CVE-2014-1529: The Web Notification API in Mozilla Firefox before 29↗2014-04-29
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2014-04-30
▶
Ubuntu
Firefox vulnerabilities↗2014-04-29
▶
Red Hat
Mozilla: Privilege escalation through Web Notification API (MFSA 2014-42)↗2014-04-29
▶

💬Community

1
Bugzilla
CVE-2014-1529 Mozilla: Privilege escalation through Web Notification API (MFSA 2014-42)↗2014-04-29
▶