« Volver al listado

CVE-2014-1586

Estado: ModificadaMedia (5)—

content/base/src/nsDocument.cpp en Mozilla Firefox anterior a 33.0, Firefox ESR 31.x anterior a 31.2, y Thunderbird 31.x anterior a 31.2 no considera si el intercambio de vídeos WebRTC está ocurriendo, lo que permite a atacantes remotos obtener información sensible de la camera local en ciertas situaciones IFRAME mediante el mantenimiento de una sesión después de que el usuario temporal sale a navegar.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Mozilla — FirefoxMozilla — Thunderbird

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2014-1586",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-10-15T10:55:07.083",
  "references": [
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/61387",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/62021",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/62022",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://secunia.com/advisories/62023",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-3050",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-3061",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-81.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/70427",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1031028",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1031030",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2372-1",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2373-1",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1062981",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/61387",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/62021",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/62022",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/62023",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-3050",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2014/dsa-3061",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-81.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/70427",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1031028",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1031030",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2372-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-2373-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1062981",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away."
    },
    {
      "lang": "es",
      "value": "content/base/src/nsDocument.cpp en Mozilla Firefox anterior a 33.0, Firefox ESR 31.x anterior a 31.2, y Thunderbird 31.x anterior a 31.2 no considera si el intercambio de vídeos WebRTC está ocurriendo, lo que permite a atacantes remotos obtener información sensible de la camera local en ciertas situaciones IFRAME mediante el mantenimiento de una sesión después de que el usuario temporal sale a navegar."
    }
  ],
  "lastModified": "2026-06-17T00:05:13.877",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97A0B769-5287-4E95-874B-F1D7FC41C7AF",
              "versionEndIncluding": "32.0"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:30.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38EBC9E7-46AD-4DCD-AA7B-5071F55E3755"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C11F024A-A8B7-405B-8A13-4BF406FBDB22"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:31.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D81A3698-797C-4CD9-BB02-A9182E0A6E11"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:31.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "707DE052-DE3E-4FC3-994C-52FF7B5373C1"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:31.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "547FD734-8E0C-452A-AB2E-5F7307B42CEB"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C11F024A-A8B7-405B-8A13-4BF406FBDB22"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:31.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D81A3698-797C-4CD9-BB02-A9182E0A6E11"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}