« Volver al listado

CVE-2014-1539

Estado: ModificadaMedia (5)—

Mozilla Firefox anterior a 30.0 y Thunderbird hasta 24.6 en OS X no aseguran la visibilidad del cursor después de una interacción con un objeto Flash y un elemento DIV, lo que facilita a atacantes remotos realizar ataques de clickjacking a través de código JavaScript que produce un imagen del cursor falso.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Mozilla — FirefoxMozilla — Thunderbird

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-1539",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-06-11T10:57:17.893",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-07/msg00001.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/59171",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/59387",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/59486",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-50.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/67967",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1030388",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=995603",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-06/msg00040.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-07/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/59171",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/59387",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/59486",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-50.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/67967",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1030388",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=995603",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mozilla Firefox before 30.0 and Thunderbird through 24.6 on OS X do not ensure visibility of the cursor after interaction with a Flash object and a DIV element, which makes it easier for remote attackers to conduct clickjacking attacks via JavaScript code that produces a fake cursor image."
    },
    {
      "lang": "es",
      "value": "Mozilla Firefox anterior a 30.0 y Thunderbird hasta 24.6 en OS X no aseguran la visibilidad del cursor después de una interacción con un objeto Flash y un elemento DIV, lo que facilita a atacantes remotos realizar ataques de clickjacking a través de código JavaScript que produce un imagen del cursor falso."
    }
  ],
  "lastModified": "2026-06-17T00:05:06.727",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8B8514D-277D-4D79-84E3-73BF050CE927",
              "versionEndIncluding": "29.0.1"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0B063ED-8BD8-4E14-8990-D23CCB0A20BB",
              "versionEndIncluding": "24.6"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CCAFDF1-10BB-4AB0-9C9D-E99DDBA901BB"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31EE89B8-705F-4A05-9015-3D6E81D394E9"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E30AE3D4-6A3E-435E-BDBF-1A9A17297433"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B0C705A0-62C0-485A-A077-C7DD426F80B5"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66C802A7-E4D5-4D2D-9CE8-749A75DF7461"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E8A57FA-AC27-4288-8E42-97DECF3B993C"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D474B11-98D0-41A3-A98B-CFB6955264AE"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:24.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6BBD940E-9EF0-460B-A721-E70C719F2244"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0FF5999A-9D12-4CDD-8DE9-A89C10B2D574"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}