CVE-2014-1480
Summary
| CVE | CVE-2014-1480 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-02-06 05:44:00 UTC |
| Updated | 2020-08-21 18:40:00 UTC |
| Description | The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site. |
Risk And Classification
Problem Types: CWE-1021
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 13.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 12.10 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 13.10 | All | All | All |
| Application | Mozilla | Firefox | All | All | All | All |
| Application | Mozilla | Firefox | All | All | All | All |
| Application | Mozilla | Seamonkey | All | All | All | All |
| Application | Mozilla | Seamonkey | All | All | All | All |
| Operating System | Opensuse | Opensuse | 11.4 | All | All | All |
| Operating System | Opensuse | Opensuse | 12.3 | All | All | All |
| Operating System | Opensuse | Opensuse | 13.1 | All | All | All |
| Operating System | Opensuse | Opensuse | 11.4 | All | All | All |
| Operating System | Opensuse | Opensuse | 12.3 | All | All | All |
| Operating System | Opensuse | Opensuse | 13.1 | All | All | All |
| Operating System | Oracle | Solaris | 11.3 | All | All | All |
| Operating System | Oracle | Solaris | 11.3 | All | All | All |
| Operating System | Suse | Linux Enterprise Desktop | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Desktop | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Server | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Software Development Kit | 11 | sp3 | All | All |
| Operating System | Suse | Linux Enterprise Software Development Kit | 11 | sp3 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Oracle Solaris Bulletin - April 2016 | CONFIRM | www.oracle.com | Third Party Advisory |
| MFSA 2014-03: UI selection timeout missing on download prompts | CONFIRM | www.mozilla.org | Vendor Advisory |
| [security-announce] openSUSE-SU-2014:0212-1: important: Mozilla Firefox | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| Mozilla Firefox/SeaMonkey CVE-2014-1480 Security Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Gentoo Security | GENTOO | security.gentoo.org | Third Party Advisory |
| USN-2102-1: Firefox vulnerabilities | Ubuntu | UBUNTU | www.ubuntu.com | Third Party Advisory |
| Security Advisory SA56888 - Ubuntu update for firefox - Secunia | SECUNIA | secunia.com | Broken Link |
| 916726 – (CVE-2014-1480) Download "open file" dialog delay is too quick, doesn't prevent clickjacking | CONFIRM | bugzilla.mozilla.org | Issue Tracking, Vendor Advisory |
| Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| [security-announce] SUSE-SU-2014:0248-1: important: Security update for | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | Third Party Advisory, VDB Entry |
| USN-2102-2: Firefox regression | Ubuntu | UBUNTU | www.ubuntu.com | Third Party Advisory |
| 102867 | OSVDB | osvdb.org | Broken Link |
| [security-announce] openSUSE-SU-2014:0419-1: important: Mozilla updates | SUSE | lists.opensuse.org | Mailing List, Third Party Advisory |
| Mozilla Seamonkey Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Potentially Sensitive Information - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.