CVEvulnerability

CVE-2014-1505

7.5 HIGH Published 2014-03-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2014-03-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693.

Affected configurations

• mozilla firefox (< 28.0) • mozilla firefox (>= 24.0 < 24.4) • mozilla seamonkey (< 2.25) • mozilla thunderbird (< 24.4) • canonical ubuntu linux 12.04 • canonical ubuntu linux 12.10 • canonical ubuntu linux 13.10 • debian debian linux 7.0 • debian debian linux 8.0 • redhat enterprise linux desktop 5.0 • redhat enterprise linux desktop 6.0 • redhat enterprise linux eus 6.5 • redhat enterprise linux server 5.0 • redhat enterprise linux server 6.0 • redhat enterprise linux server aus 6.5 • redhat enterprise linux server eus 6.5 • redhat enterprise linux server tus 6.5 • redhat enterprise linux workstation 5.0 • redhat enterprise linux workstation 6.0 • novell suse linux enterprise software development kit 11.0 • opensuse opensuse 11.4 • opensuse opensuse 12.3 • opensuse opensuse 13.1 • suse suse linux enterprise desktop 11 • suse suse linux enterprise server 11

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References