CVE-2014-8632

The structured-clone implementation in Mozilla Firefox before 34.0 and SeaMonkey before 2.31 does not properly interact with XrayWrapper property filtering, which allows remote attackers to bypass intended DOM object restrictions by leveraging property availability after XrayWrapper removal.

Score

CVSS 2.0 4.3 Medium

Status

Modified - security@mozilla.org

Published

2014-12-11

Last modified

2024-08-06

Weaknesses

CWE-284

Affected products

• Firefox (Mozilla)
• Seamonkey (Mozilla)

References

• http://www.mozilla.org/security/announce/2014/mfsa2014-91.html
• http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
• https://bugzilla.mozilla.org/show_bug.cgi?id=1050340
• https://security.gentoo.org/glsa/201504-01