CVEvulnerability
CVE-2014-1561
5.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-07-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.8 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-264
Description
Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.
Affected configurations
• mozilla firefox (<= 30.0)
• oracle solaris 11.3
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/59760 secunia.com
- http://secunia.com/advisories/60628 secunia.com
- http://www.mozilla.org/security/announce/2014/mfsa2014-60.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
- http://www.securitytracker.com/id/1030619 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1000514 Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=910375 Issue Tracking
- https://security.gentoo.org/glsa/201504-01 security.gentoo.org
- http://secunia.com/advisories/59760 secunia.com
- http://secunia.com/advisories/60628 secunia.com
- http://www.mozilla.org/security/announce/2014/mfsa2014-60.html Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
- http://www.securitytracker.com/id/1030619 www.securitytracker.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1000514 Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=910375 Issue Tracking
- https://security.gentoo.org/glsa/201504-01 security.gentoo.org