First Last Prev Next    This bug is not in your last search results.
Bug 862348 - (CVE-2014-1479) VUL-0: CVE-2014-1479: Firefox/Thunderbird/Seamonkey: Clone protected content with XBL scopes
(CVE-2014-1479)
VUL-0: CVE-2014-1479: Firefox/Thunderbird/Seamonkey: Clone protected conten...
Status: RESOLVED DUPLICATE of bug 861847
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Wolfgang Rosenauer
Security Team bot
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2014-02-05 13:24 UTC by Victor Pereira
Modified: 2014-02-10 10:44 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2014-02-05 13:24:54 UTC 
CVE-2014-1479

Security researcher Cody Crews reported a method to bypass System Only Wrappers (SOW) by using XML Binding Language (XBL) content scopes to clone protected XUL elements. This could be used to clone anonymous nodes, making trusted XUL content web accessible. 

References:
http://www.mozilla.org/security/announce/2014/mfsa2014-02.html
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1479
https://bugzilla.redhat.com/show_bug.cgi?id=1060940
Comment 1 Swamp Workflow Management 2014-02-05 23:07:29 UTC 
bugbot adjusting priority
Comment 2 Alexander Bergmann 2014-02-10 10:44:16 UTC 
problem is covered with new Firefox version

*** This bug has been marked as a duplicate of bug 861847 ***
First Last Prev Next    This bug is not in your last search results.