VYPR
← All advisories
High severity7.5NVD Advisory· Published Feb 6, 2014· Updated Apr 29, 2026

CVE-2014-1479

CVE-2014-1479

Description

System Only Wrapper (SOW) in Firefox <27, Thunderbird <24.3, SeaMonkey <2.24 allows XBL content scope bypass, enabling cloning of restricted XUL content.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

System Only Wrapper (SOW) in Firefox <27, Thunderbird <24.3, SeaMonkey <2.24 allows XBL content scope bypass, enabling cloning of restricted XUL content.

Vulnerability

The System Only Wrapper (SOW) implementation in Mozilla Firefox before version 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 fails to properly restrict cloning operations involving XBL content scopes [1][2][3]. This flaw allows remote attackers to bypass intended security restrictions on XUL content by exploiting vectors that manipulate XBL content scopes [4]. The vulnerability, tracked as CVE-2014-1479 and reported by Cody Crews, enables the theft (cloning) of native anonymous content, which should be protected from web-accessible scripts [4].

Exploitation

An attacker can exploit this vulnerability by crafting malicious web content that triggers the cloning of native anonymous XUL content through XBL scopes [4]. The attacker does not require any special authentication or user privileges; the exploitation occurs when a user visits a specially crafted web page using a vulnerable browser [1][2]. The attacker must induce the user to open the malicious content. In the case of Thunderbird, scripting must be enabled in the mail client for successful exploitation [3].

Impact

Successful exploitation allows an attacker to bypass the XUL content restrictions that SOW is intended to enforce [1][2][3]. This can lead to a denial of service (crash) of the browser or mail client, and when combined with other vulnerabilities, could potentially enable arbitrary code execution with the privileges of the user running the application [1][3]. Additionally, the flaw could be used to steal confidential data from the user's session [3].

Mitigation

Mozilla addressed this vulnerability in Firefox 27.0, Firefox ESR 24.3, Thunderbird 24.3, and SeaMonkey 2.24 [1][2][3]. Red Hat released updated packages (RHSA-2014:0132 and RHSA-2014:0133) for Red Hat Enterprise Linux 5 and 6 [1][2]. Ubuntu issued USN-2119-1 covering Thunderbird on Ubuntu 12.04 LTS, 13.10, and 13.04 [3]. Users should update to the fixed versions as soon as possible. No workaround is available beyond the patched release.

References
  1. http://rhn.redhat.com/errata/RHSA-2014-0132.html
  2. http://rhn.redhat.com/errata/RHSA-2014-0133.html
  3. USN-2119-1: Thunderbird vulnerabilities | Ubuntu security notices | Ubuntu
  4. 911864 - (CVE-2014-1479) Using XBL scopes its possible to steal(clone) native anonymous content.

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

33

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

33

News mentions

0

No linked articles in our index yet.