Description
Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Advisories 2
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- openSUSE-SU-2014:0212 vendor-advisory
- 1029717 vdb-entry
- https://8pecxstudios.com/?page_id=44080
- 56787 third-party-advisory
- 1029720 vdb-entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=950427
- 65316 vdb-entry
- USN-2102-2 vendor-advisory
- GLSA-201504-01 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- firefox-cve20141483-info-disc(90893) vdb-entry
- 56888 third-party-advisory
- openSUSE-SU-2014:0419 vendor-advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-05.html
- 102869 vdb-entry
- SUSE-SU-2014:0248 vendor-advisory
- USN-2102-1 vendor-advisory
- 56767 third-party-advisory
- 56706 third-party-advisory