Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2014-1586 | First vendor Publication | 2014-10-15 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1586 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:27048 | |||
| Oval ID: | oval:org.mitre.oval:def:27048 | ||
| Title: | USN-2373-1 -- Thunderbird vulnerabilities | ||
| Description: | Bobby Holley, Christian Holler, David Bolter, Byron Campen and Jon Coppeard discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (<a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2014-1574">CVE-2014-1574</a>) Atte Kettunen discovered a buffer overflow during CSS manipulation. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (<a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2014-1576">CVE-2014-1576</a>) Holger Fuhrmannek discovered an out-of-bounds read with Web Audio. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to steal sensitive information. (<a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2014-1577">CVE-2014-1577</a>) Abhishek Arya discovered an out-of-bounds write when buffering WebM video in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (<a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2014-1578">CVE-2014-1578</a>) A use-after-free was discovered during text layout in some circumstances. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash or execute arbitrary code with the privileges of the user invoking Thunderbird. (<a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2014-1581">CVE-2014-1581</a>) Eric Shepherd and Jan-Ivar Bruaroey discovered issues with video sharing via WebRTC in iframes, where video continues to be shared after being stopped and navigating to a new site doesn't turn off the camera. An attacker could potentially exploit this to access the camera without the user being aware. (<a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2014-1585">CVE-2014-1585</a>, <a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2014-1586">CVE-2014-1586</a>) | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2373-1 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1585 CVE-2014-1586 | Version: | 3 |
| Platform(s): | Ubuntu 14.04 Ubuntu 12.04 | Product(s): | thunderbird |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27600 | |||
| Oval ID: | oval:org.mitre.oval:def:27600 | ||
| Title: | SUSE-SU-2014:1458-3 -- Security update for MozillaFirefox (important) | ||
| Description: | This version update of Mozilla Firefox to 31.2.0ESR brings improvements, stability fixes and also security fixes for the following CVEs: CVE-2014-1574, CVE-2014-1575, CVE-2014-1576 ,CVE-2014-1577, CVE-2014-1578, CVE-2014-1581, CVE-2014-1583, CVE-2014-1585, CVE-2014-1586 It also disables SSLv3 by default to mitigate the protocol downgrade attack known as POODLE. Security Issues: * CVE-2014-1574 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1574> * CVE-2014-1575 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1575> * CVE-2014-1576 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1576> * CVE-2014-1577 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1577> * CVE-2014-1578 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1578> * CVE-2014-1581 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1581> * CVE-2014-1583 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1583> * CVE-2014-1585 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1585> * CVE-2014-1586 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1586> | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:1458-3 CVE-2014-1574 CVE-2014-1575 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1583 CVE-2014-1585 CVE-2014-1586 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 10 | Product(s): | MozillaFirefox |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:28072 | |||
| Oval ID: | oval:org.mitre.oval:def:28072 | ||
| Title: | DEPRECATED: DSA-3050-2 -- xulrunner update | ||
| Description: | Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, denial of service, the bypass of the same-origin policy or a loss of privacy. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-3050-2 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1583 CVE-2014-1585 CVE-2014-1586 | Version: | 4 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | iceweasel |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:28243 | |||
| Oval ID: | oval:org.mitre.oval:def:28243 | ||
| Title: | DSA-3061-1 -- icedove security update | ||
| Description: | Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client: Multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code or denial of service. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-3061-1 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1585 CVE-2014-1586 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | icedove |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:28285 | |||
| Oval ID: | oval:org.mitre.oval:def:28285 | ||
| Title: | DSA-3050-3 -- iceweasel security update | ||
| Description: | Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows, use-after-frees and other implementation errors may lead to the execution of arbitrary code, denial of service, the bypass of the same-origin policy or a loss of privacy. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-3050-3 CVE-2014-1574 CVE-2014-1576 CVE-2014-1577 CVE-2014-1578 CVE-2014-1581 CVE-2014-1583 CVE-2014-1585 CVE-2014-1586 | Version: | 3 |
| Platform(s): | Debian GNU/Linux 7.0 Debian GNU/kFreeBSD 7.0 | Product(s): | iceweasel |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-05-27 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-1510-1.nasl - Type : ACT_GATHER_INFO |
| 2015-05-27 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-1458-3.nasl - Type : ACT_GATHER_INFO |
| 2015-05-27 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-1458-2.nasl - Type : ACT_GATHER_INFO |
| 2015-05-27 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-1458-1.nasl - Type : ACT_GATHER_INFO |
| 2015-04-08 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201504-01.nasl - Type : ACT_GATHER_INFO |
| 2014-12-18 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-784.nasl - Type : ACT_GATHER_INFO |
| 2014-11-20 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_firefox31-201411-141115.nasl - Type : ACT_GATHER_INFO |
| 2014-11-11 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_firefox31-201411-141105.nasl - Type : ACT_GATHER_INFO |
| 2014-11-03 | Name : The remote Fedora host is missing a security update. File : fedora_2014-14084.nasl - Type : ACT_GATHER_INFO |
| 2014-11-03 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-614.nasl - Type : ACT_GATHER_INFO |
| 2014-11-03 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-613.nasl - Type : ACT_GATHER_INFO |
| 2014-11-03 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-612.nasl - Type : ACT_GATHER_INFO |
| 2014-11-03 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-611.nasl - Type : ACT_GATHER_INFO |
| 2014-11-03 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3061.nasl - Type : ACT_GATHER_INFO |
| 2014-10-20 | Name : The remote Fedora host is missing a security update. File : fedora_2014-13042.nasl - Type : ACT_GATHER_INFO |
| 2014-10-20 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3050.nasl - Type : ACT_GATHER_INFO |
| 2014-10-16 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2373-1.nasl - Type : ACT_GATHER_INFO |
| 2014-10-16 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_9c1495ac8d8c4789a0f38ca6b476619c.nasl - Type : ACT_GATHER_INFO |
| 2014-10-15 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_31_2_esr.nasl - Type : ACT_GATHER_INFO |
| 2014-10-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2372-1.nasl - Type : ACT_GATHER_INFO |
| 2014-10-15 | Name : The remote Windows host contains a mail client that is affected by multiple v... File : mozilla_thunderbird_31_2.nasl - Type : ACT_GATHER_INFO |
| 2014-10-15 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_33.nasl - Type : ACT_GATHER_INFO |
| 2014-10-15 | Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_31_2_esr.nasl - Type : ACT_GATHER_INFO |
| 2014-10-15 | Name : The remote Mac OS X host contains a mail client that is affected by multiple ... File : macosx_thunderbird_31_2.nasl - Type : ACT_GATHER_INFO |
| 2014-10-15 | Name : The remote Mac OS X host contains a web browser that is affected by multiple ... File : macosx_firefox_33.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 12:39:29 |
|
| 2024-11-01 01:26:58 |
|
| 2024-10-23 09:28:23 |
|
| 2024-10-22 17:28:15 |
|
| 2024-10-22 09:28:12 |
|
| 2024-10-21 17:28:18 |
|
| 2024-08-02 12:27:21 |
|
| 2024-08-02 01:08:11 |
|
| 2024-02-10 01:24:24 |
|
| 2024-02-02 01:26:35 |
|
| 2024-02-01 12:07:52 |
|
| 2023-09-05 12:25:10 |
|
| 2023-09-05 01:07:46 |
|
| 2023-09-02 12:25:08 |
|
| 2023-09-02 01:07:53 |
|
| 2023-08-12 12:27:24 |
|
| 2023-08-12 01:07:23 |
|
| 2023-08-11 12:23:17 |
|
| 2023-08-11 01:07:34 |
|
| 2023-08-06 12:22:39 |
|
| 2023-08-06 01:07:21 |
|
| 2023-08-04 12:22:40 |
|
| 2023-08-04 01:07:25 |
|
| 2023-07-14 12:22:39 |
|
| 2023-07-14 01:07:24 |
|
| 2023-04-01 01:19:08 |
|
| 2023-03-29 01:24:33 |
|
| 2023-03-28 12:07:45 |
|
| 2022-10-11 12:20:26 |
|
| 2022-10-11 01:07:33 |
|
| 2021-05-04 12:30:07 |
|
| 2021-04-22 01:36:18 |
|
| 2020-10-14 01:10:50 |
|
| 2020-10-03 01:10:56 |
|
| 2020-05-29 01:09:59 |
|
| 2020-05-23 01:51:16 |
|
| 2020-05-23 00:40:03 |
|
| 2018-12-04 12:05:43 |
|
| 2018-01-18 12:05:59 |
|
| 2017-11-22 12:05:57 |
|
| 2016-12-24 09:24:02 |
|
| 2016-12-22 09:23:38 |
|
| 2016-10-25 09:21:51 |
|
| 2016-06-28 22:36:23 |
|
| 2015-05-28 13:27:48 |
|
| 2015-04-09 13:29:00 |
|
| 2015-03-18 09:26:34 |
|
| 2014-12-19 13:24:31 |
|
| 2014-11-21 13:25:01 |
|
| 2014-11-19 09:23:15 |
|
| 2014-11-14 13:27:41 |
|
| 2014-11-12 13:27:09 |
|
| 2014-11-04 13:27:29 |
|
| 2014-10-21 21:24:43 |
|
| 2014-10-20 13:24:55 |
|
| 2014-10-17 13:25:27 |
|
| 2014-10-16 13:25:19 |
|
| 2014-10-15 17:22:29 |
|
