CVE-2014-1586

EUVD-2014-1662
content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
≤ 32.0
mozillafirefox
30.0
mozillafirefox
31.0
mozillafirefox
31.1.0
mozillathunderbird
31.0
mozillathunderbird
31.1.0
mozillafirefox
31.0
mozillafirefox
31.1.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
lucid
ignored
precise
Fixed 33.0+build2-0ubuntu0.12.04.1
released
trusty
Fixed 33.0+build2-0ubuntu0.14.04.1
released
thunderbird
lucid
ignored
precise
Fixed 1:31.2.0+build2-0ubuntu0.12.04.1
released
trusty
Fixed 1:31.2.0+build2-0ubuntu0.14.04.1
released
References
http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html
http://secunia.com/advisories/61387
http://secunia.com/advisories/62021
http://secunia.com/advisories/62022
http://secunia.com/advisories/62023
http://www.debian.org/security/2014/dsa-3050
http://www.debian.org/security/2014/dsa-3061
http://www.mozilla.org/security/announce/2014/mfsa2014-81.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
http://www.securityfocus.com/bid/70427
http://www.securitytracker.com/id/1031028
http://www.securitytracker.com/id/1031030
http://www.ubuntu.com/usn/USN-2372-1
http://www.ubuntu.com/usn/USN-2373-1
https://bugzilla.mozilla.org/show_bug.cgi?id=1062981
https://security.gentoo.org/glsa/201504-01
http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html
http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html
http://secunia.com/advisories/61387
http://secunia.com/advisories/62021
http://secunia.com/advisories/62022
http://secunia.com/advisories/62023
http://www.debian.org/security/2014/dsa-3050
http://www.debian.org/security/2014/dsa-3061
http://www.mozilla.org/security/announce/2014/mfsa2014-81.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
http://www.securityfocus.com/bid/70427
http://www.securitytracker.com/id/1031028
http://www.securitytracker.com/id/1031030
http://www.ubuntu.com/usn/USN-2372-1
http://www.ubuntu.com/usn/USN-2373-1
https://bugzilla.mozilla.org/show_bug.cgi?id=1062981
https://security.gentoo.org/glsa/201504-01