CVE-2014-1504

Published: Mar 19, 2014Modified: May 6, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart.

Affected (10)

Products: Mozilla: Firefox, Seamonkey · Opensuse: Opensuse · Oracle: Solaris · +1 more

Show all products

Mozilla: Firefox, Seamonkey · Opensuse: Opensuse · Oracle: Solaris · Suse: Linux Enterprise Desktop, Linux Enterprise Sdk, Linux Enterprise Server

2 products

1 product

1 product

3 products

Linux Enterprise Desktop

Linux Enterprise Sdk

Linux Enterprise Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Before 28.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Seamonkey	Before 2.25

Configuration C

8 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 11.4
Opensuse Opensuse	Version 12.3
Opensuse Opensuse	Version 13.1
Oracle Solaris	Version 11.3
Suse Linux Enterprise Desktop	Version 11 sp3
Suse Linux Enterprise Sdk	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp3
Suse Linux Enterprise Server	Version 11 sp3

Related CWEs

References (16)

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html

Source: security@mozilla.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html

Source: security@mozilla.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html

Source: security@mozilla.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.html

Source: security@mozilla.org

Third Party Advisory

http://www.mozilla.org/security/announce/2014/mfsa2014-23.html

Source: security@mozilla.org

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: security@mozilla.org

Third Party Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=911547

Source: security@mozilla.org

Issue TrackingVendor Advisory

https://security.gentoo.org/glsa/201504-01

Source: security@mozilla.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00022.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.mozilla.org/security/announce/2014/mfsa2014-23.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=911547

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://security.gentoo.org/glsa/201504-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.