Published: 06/02/2014 Updated: 14/02/2024

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The Content Security Policy (CSP) implementation in Mozilla Firefox prior to 27.0 and SeaMonkey prior to 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote malicious users to execute arbitrary XSLT code by leveraging insufficient style-src restrictions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla seamonkey
mozilla firefox
oracle solaris 11.3
canonical ubuntu linux 13.10
canonical ubuntu linux 12.10
canonical ubuntu linux 12.04
suse linux enterprise desktop 11
suse linux enterprise server 11
opensuse opensuse 12.3
suse linux enterprise software development kit 11
opensuse opensuse 11.4
opensuse opensuse 13.1

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

USN-2102-1 introduced a regression in Firefox ...

Mozilla Foundation Security Advisory 2014-07 XSLT stylesheets treated as styles in Content Security Policy Announced February 4, 2014 Reporter Frederik Braun Impact Moderate Products Firefox, SeaMonkey Fixed in ...

The Content Security Policy (CSP) implementation in Mozilla Firefox before 270 and SeaMonkey before 224 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions ...

NVD-CWE-noinfo http://www.mozilla.org/security/announce/2014/mfsa2014-07.html https://bugzilla.mozilla.org/show_bug.cgi?id=910139 https://8pecxstudios.com/?page_id=44080 http://secunia.com/advisories/56706 http://www.ubuntu.com/usn/USN-2102-1 http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html http://www.ubuntu.com/usn/USN-2102-2 http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html https://security.gentoo.org/glsa/201504-01 https://exchange.xforce.ibmcloud.com/vulnerabilities/90891 http://www.securitytracker.com/id/1029720 http://www.securitytracker.com/id/1029717 http://www.securityfocus.com/bid/65322 http://secunia.com/advisories/56888 http://secunia.com/advisories/56787 http://secunia.com/advisories/56767 http://osvdb.org/102871 https://usn.ubuntu.com/2102-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-1485

CVE-2014-1485

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect