Bug 862348 (CVE-2014-1479) - VUL-0: CVE-2014-1479: Firefox/Thunderbird/Seamonkey: Clone protected content with XBL scopes
Summary: VUL-0: CVE-2014-1479: Firefox/Thunderbird/Seamonkey: Clone protected conten...
Status: RESOLVED DUPLICATE of bug 861847
Alias: CVE-2014-1479
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Wolfgang Rosenauer
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-05 13:24 UTC by Victor Pereira
Modified: 2014-02-10 10:44 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2014-02-05 13:24:54 UTC 
CVE-2014-1479

Security researcher Cody Crews reported a method to bypass System Only Wrappers (SOW) by using XML Binding Language (XBL) content scopes to clone protected XUL elements. This could be used to clone anonymous nodes, making trusted XUL content web accessible. 

References:
http://www.mozilla.org/security/announce/2014/mfsa2014-02.html
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1479
https://bugzilla.redhat.com/show_bug.cgi?id=1060940
Comment 1 Swamp Workflow Management 2014-02-05 23:07:29 UTC 
bugbot adjusting priority
Comment 2 Alexander Bergmann 2014-02-10 10:44:16 UTC 
problem is covered with new Firefox version

*** This bug has been marked as a duplicate of bug 861847 ***