5.5

CVE-2014-1496

Exploit
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted Mar contents during an update.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version < 28.0
Mozilla ≫ Firefox Version >= 24.0 < 24.4
Mozilla ≫ Seamonkey Version < 2.25
Mozilla ≫ Thunderbird Version < 24.4
Suse ≫ Suse Linux Enterprise Desktop Version11 Updatesp3
Suse ≫ Suse Linux Enterprise Server Version11 Updatesp3
Suse ≫ Suse Linux Enterprise Server Version11 Updatesp3 SwPlatformvmware
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.06% 0.167
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvd@nist.gov 1.9 3.4 2.9
AV:L/AC:M/Au:N/C:N/I:P/A:N
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://bugzilla.mozilla.org/show_bug.cgi?id=925747
Vendor Advisory
Exploit
Issue Tracking