Description
Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.
Metrics
CVSS 2.0 5.0/10
AV:N/AC:L/Au:N/C:P/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing List, Third Party Advisory
- http://osvdb.org/102869Broken Link
- http://secunia.com/advisories/56706Broken Link
- http://secunia.com/advisories/56767Broken Link
- http://secunia.com/advisories/56787Broken Link
- http://secunia.com/advisories/56888Broken Link
- http://www.mozilla.org/security/announce/2014/mfsa2014-05.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.securityfocus.com/bid/65316Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029717Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029720Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2102-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2102-2Third Party Advisory
- https://8pecxstudios.com/?page_id=44080Broken Link, URL Repurposed
- https://bugzilla.mozilla.org/show_bug.cgi?id=950427Issue Tracking, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90893Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201504-01Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.htmlMailing List, Third Party Advisory
- http://osvdb.org/102869Broken Link
- http://secunia.com/advisories/56706Broken Link
- http://secunia.com/advisories/56767Broken Link
- http://secunia.com/advisories/56787Broken Link
- http://secunia.com/advisories/56888Broken Link
- http://www.mozilla.org/security/announce/2014/mfsa2014-05.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.securityfocus.com/bid/65316Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029717Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1029720Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2102-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2102-2Third Party Advisory
- https://8pecxstudios.com/?page_id=44080Broken Link, URL Repurposed
- https://bugzilla.mozilla.org/show_bug.cgi?id=950427Issue Tracking, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90893Third Party Advisory, VDB Entry
- https://security.gentoo.org/glsa/201504-01Third Party Advisory
Timeline
- Published
- Feb 6, 2014
- Last modified
- Jun 17, 2026
- NVD status
- Modified