CVE-2014-1529: High severity Mozilla Firefox vulnerability
The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 29.0 - Upgrade
Upgrade
Mozilla Firefox ESR 24.xto a version that resolves this vulnerability.Fixed in 24.5 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 24.5 - Upgrade
Upgrade
Mozilla SeaMonkeyto a version that resolves this vulnerability.Fixed in 2.26
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1529?
CVE-2014-1529 has a medium severity rating, which means it poses a significant risk to affected systems.
How do I fix CVE-2014-1529?
To mitigate CVE-2014-1529, users should update to Mozilla Firefox version 29.0 or later, or the latest versions of affected applications.
Which applications are affected by CVE-2014-1529?
CVE-2014-1529 affects Mozilla Firefox versions before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26.
Can outdated Ubuntu versions be vulnerable to CVE-2014-1529?
Yes, specific versions of Ubuntu such as 12.04, 12.10, 13.10, and 14.04 may be vulnerable to CVE-2014-1529 if they are running the affected applications without patches.
What kind of attack can be executed using CVE-2014-1529?
CVE-2014-1529 allows remote attackers to bypass source-component restrictions and execute arbitrary JavaScript code in a privileged context.