Published: 06/02/2014 Updated: 21/08/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

The file-download implementation in Mozilla Firefox prior to 27.0 and SeaMonkey prior to 2.24 does not properly restrict the timing of button selections, which allows remote malicious users to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.

Vulnerable Product	Search on Vulmon	Subscribe to Product
opensuse opensuse 11.4
opensuse opensuse 12.3
opensuse opensuse 13.1
suse linux enterprise desktop 11
suse linux enterprise server 11
suse linux enterprise software development kit 11
oracle solaris 11.3
canonical ubuntu linux 12.04
canonical ubuntu linux 12.10
canonical ubuntu linux 13.10
mozilla firefox
mozilla seamonkey

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

USN-2102-1 introduced a regression in Firefox ...

Mozilla Foundation Security Advisory 2014-03 UI selection timeout missing on download prompts Announced February 4, 2014 Reporter Jordi Chancel Impact Moderate Products Firefox, SeaMonkey Fixed in ...

The file-download implementation in Mozilla Firefox before 270 and SeaMonkey before 224 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site ...

CWE-1021 http://www.mozilla.org/security/announce/2014/mfsa2014-03.html https://bugzilla.mozilla.org/show_bug.cgi?id=916726 http://www.ubuntu.com/usn/USN-2102-1 http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html http://www.ubuntu.com/usn/USN-2102-2 http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://security.gentoo.org/glsa/201504-01 https://exchange.xforce.ibmcloud.com/vulnerabilities/90897 http://www.securitytracker.com/id/1029720 http://www.securitytracker.com/id/1029717 http://www.securityfocus.com/bid/65331 http://secunia.com/advisories/56888 http://osvdb.org/102867 https://nvd.nist.gov https://usn.ubuntu.com/2102-1/https://access.redhat.com/security/cve/cve-2014-1480

CVE-2014-1480

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect