{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-10-14T00:00:00", "descriptions": [{"lang": "en", "value": "content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-12-22T18:57:01", "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla"}, "references": [{"name": "62021", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/62021"}, {"name": "openSUSE-SU-2015:0138", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"}, {"name": "openSUSE-SU-2014:1344", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"}, {"name": "openSUSE-SU-2014:1346", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"}, {"name": "FEDORA-2014-13042", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-81.html"}, {"name": "1031028", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1031028"}, {"name": "openSUSE-SU-2014:1345", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"}, {"name": "USN-2373-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2373-1"}, {"name": "GLSA-201504-01", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201504-01"}, {"name": "FEDORA-2014-14084", "tags": ["vendor-advisory", "x_refsource_FEDORA"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"}, {"name": "61387", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/61387"}, {"name": "USN-2372-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2372-1"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"name": "62022", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/62022"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1062981"}, {"name": "openSUSE-SU-2015:1266", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"name": "1031030", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1031030"}, {"name": "62023", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/62023"}, {"name": "openSUSE-SU-2014:1343", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"}, {"name": "DSA-3050", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2014/dsa-3050"}, {"name": "70427", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/70427"}, {"name": "DSA-3061", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2014/dsa-3061"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@mozilla.org", "ID": "CVE-2014-1586", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "62021", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/62021"}, {"name": "openSUSE-SU-2015:0138", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"}, {"name": "openSUSE-SU-2014:1344", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"}, {"name": "openSUSE-SU-2014:1346", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"}, {"name": "FEDORA-2014-13042", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"}, {"name": "http://www.mozilla.org/security/announce/2014/mfsa2014-81.html", "refsource": "CONFIRM", "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-81.html"}, {"name": "1031028", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1031028"}, {"name": "openSUSE-SU-2014:1345", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"}, {"name": "USN-2373-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2373-1"}, {"name": "GLSA-201504-01", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201504-01"}, {"name": "FEDORA-2014-14084", "refsource": "FEDORA", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"}, {"name": "61387", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/61387"}, {"name": "USN-2372-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2372-1"}, {"name": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html", "refsource": "CONFIRM", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"name": "62022", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/62022"}, {"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1062981", "refsource": "CONFIRM", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1062981"}, {"name": "openSUSE-SU-2015:1266", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"name": "1031030", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1031030"}, {"name": "62023", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/62023"}, {"name": "openSUSE-SU-2014:1343", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"}, {"name": "DSA-3050", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2014/dsa-3050"}, {"name": "70427", "refsource": "BID", "url": "http://www.securityfocus.com/bid/70427"}, {"name": "DSA-3061", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2014/dsa-3061"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T09:42:36.667Z"}, "title": "CVE Program Container", "references": [{"name": "62021", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/62021"}, {"name": "openSUSE-SU-2015:0138", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"}, {"name": "openSUSE-SU-2014:1344", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"}, {"name": "openSUSE-SU-2014:1346", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"}, {"name": "FEDORA-2014-13042", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-81.html"}, {"name": "1031028", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1031028"}, {"name": "openSUSE-SU-2014:1345", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"}, {"name": "USN-2373-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2373-1"}, {"name": "GLSA-201504-01", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201504-01"}, {"name": "FEDORA-2014-14084", "tags": ["vendor-advisory", "x_refsource_FEDORA", "x_transferred"], "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"}, {"name": "61387", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/61387"}, {"name": "USN-2372-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2372-1"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"name": "62022", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/62022"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1062981"}, {"name": "openSUSE-SU-2015:1266", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"name": "1031030", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1031030"}, {"name": "62023", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/62023"}, {"name": "openSUSE-SU-2014:1343", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"}, {"name": "DSA-3050", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2014/dsa-3050"}, {"name": "70427", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/70427"}, {"name": "DSA-3061", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2014/dsa-3061"}]}]}, "cveMetadata": {"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "cveId": "CVE-2014-1586", "datePublished": "2014-10-15T10:00:00", "dateReserved": "2014-01-16T00:00:00", "dateUpdated": "2024-08-06T09:42:36.667Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "97A0B769-5287-4E95-874B-F1D7FC41C7AF", "versionEndIncluding": "32.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:30.0:*:*:*:*:*:*:*", "matchCriteriaId": "38EBC9E7-46AD-4DCD-AA7B-5071F55E3755", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11F024A-A8B7-405B-8A13-4BF406FBDB22", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:31.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "D81A3698-797C-4CD9-BB02-A9182E0A6E11", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird:31.0:*:*:*:*:*:*:*", "matchCriteriaId": "707DE052-DE3E-4FC3-994C-52FF7B5373C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:31.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "547FD734-8E0C-452A-AB2E-5F7307B42CEB", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.0:*:*:*:*:*:*:*", "matchCriteriaId": "992DDB6B-F32C-4E80-B386-EB1643D079E4", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:31.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "19837144-FBCC-4B36-BAF4-FCD9F9C2AAE5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away."}, {"lang": "es", "value": "content/base/src/nsDocument.cpp en Mozilla Firefox anterior a 33.0, Firefox ESR 31.x anterior a 31.2, y Thunderbird 31.x anterior a 31.2 no considera si el intercambio de v\u00eddeos WebRTC est\u00e1 ocurriendo, lo que permite a atacantes remotos obtener informaci\u00f3n sensible de la camera local en ciertas situaciones IFRAME mediante el mantenimiento de una sesi\u00f3n despu\u00e9s de que el usuario temporal sale a navegar."}], "id": "CVE-2014-1586", "lastModified": "2016-12-24T02:59:01.710", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-10-15T10:55:07.083", "references": [{"source": "security@mozilla.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-November/141796.html"}, {"source": "security@mozilla.org", "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/141085.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00024.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00000.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00001.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00002.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-updates/2014-11/msg00003.html"}, {"source": "security@mozilla.org", "url": "http://secunia.com/advisories/61387"}, {"source": "security@mozilla.org", "url": "http://secunia.com/advisories/62021"}, {"source": "security@mozilla.org", "url": "http://secunia.com/advisories/62022"}, {"source": "security@mozilla.org", "url": "http://secunia.com/advisories/62023"}, {"source": "security@mozilla.org", "url": "http://www.debian.org/security/2014/dsa-3050"}, {"source": "security@mozilla.org", "url": "http://www.debian.org/security/2014/dsa-3061"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "http://www.mozilla.org/security/announce/2014/mfsa2014-81.html"}, {"source": "security@mozilla.org", "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html"}, {"source": "security@mozilla.org", "url": "http://www.securityfocus.com/bid/70427"}, {"source": "security@mozilla.org", "url": "http://www.securitytracker.com/id/1031028"}, {"source": "security@mozilla.org", "url": "http://www.securitytracker.com/id/1031030"}, {"source": "security@mozilla.org", "url": "http://www.ubuntu.com/usn/USN-2372-1"}, {"source": "security@mozilla.org", "url": "http://www.ubuntu.com/usn/USN-2373-1"}, {"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1062981"}, {"source": "security@mozilla.org", "url": "https://security.gentoo.org/glsa/201504-01"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Mozilla project for reporting this issue. Upstream acknowledges Eric Shepherd and Jan-Ivar Bruaroey as the original reporters.", "bugzilla": {"description": "Mozilla: Inconsistent video sharing within iframe (MFSA 2014-81)", "id": "1152366", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1152366"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "status": "draft"}, "details": ["content/base/src/nsDocument.cpp in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 does not consider whether WebRTC video sharing is occurring, which allows remote attackers to obtain sensitive information from the local camera in certain IFRAME situations by maintaining a session after the user temporarily navigates away."], "name": "CVE-2014-1586", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "firefox", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2014-10-14T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-1586\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-1586\nhttp://www.mozilla.org/security/announce/2014/mfsa2014-81.html"], "threat_severity": "Moderate"}