CVE-2014-1510

critical · 9.8

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript code with chrome privileges by using an IDL fragment to trigger a window.open call.

9.8

CVSS

82.3%

EPSS (exploit prob.)

100th

EPSS percentile

2014-03-19

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-269

Affected products

Vendor	Product	Affected versions
mozilla	firefox	< 28.0
mozilla	firefox	>= 24.0, < 24.4
mozilla	seamonkey	< 2.25
mozilla	thunderbird	< 24.4
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10
canonical	ubuntu_linux	13.10
debian	debian_linux	7.0
debian	debian_linux	8.0
redhat	enterprise_linux_desktop	5.0
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_eus	6.5
redhat	enterprise_linux_server	5.0
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_server_aus	6.5
redhat	enterprise_linux_server_eus	6.5
redhat	enterprise_linux_server_tus	6.5
redhat	enterprise_linux_workstation	5.0
redhat	enterprise_linux_workstation	6.0
suse	suse_linux_enterprise_software_development_kit	11.0
opensuse	opensuse	11.4
opensuse	opensuse	12.3
opensuse	opensuse	13.1
suse	suse_linux_enterprise_desktop	11
suse	suse_linux_enterprise_server	11
suse	suse_linux_enterprise_server	11

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-1510