CVE-2014-1527

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

Mozilla Firefox before 29.0 on Android allows remote attackers to spoof the address bar via crafted JavaScript code that uses DOM events to prevent the reemergence of the actual address bar after scrolling has taken it off of the screen.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.htmlThird Party Advisory
http://www.mozilla.org/security/announce/2014/mfsa2014-40.htmlVendor Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
http://www.securitytracker.com/id/1030163Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=960146Issue Tracking
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.htmlThird Party Advisory
http://www.mozilla.org/security/announce/2014/mfsa2014-40.htmlVendor Advisory
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
http://www.securitytracker.com/id/1030163Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=960146Issue Tracking

Timeline

Published: Apr 30, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-152810.0The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote a CVE-2014-15298.8The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 al CVE-2014-15306.1The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 CVE-2014-15318.8Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x b CVE-2014-15329.8Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox CVE-2014-153310.0Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and Thunderbird bef CVE-2014-153410.0Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 30.0 allow remote attackers to cause a denial of servic CVE-2014-153610.0The PropertyProvider::FindJustificationRange function in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code or ca CVE-2014-153710.0Use-after-free vulnerability in the mozilla::dom::workers::WorkerPrivateParent function in Mozilla Firefox before 30.0 allows remote attacke CVE-2014-153810.0Use-after-free vulnerability in the nsTextEditRules::CreateMozBR function in Mozilla Firefox before 30.0, Firefox ESR 24.x before 24.6, and CVE-2014-15395.0Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash objec CVE-2014-15409.3Use-after-free vulnerability in the nsEventListenerManager::CompileEventHandlerInternal function in the Event Listener Manager in Mozilla Fi