CVE-2014-1561

Description

Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.

References

https://security.gentoo.org/glsa/201504-01

https://bugzilla.mozilla.org/show_bug.cgi?id=910375

https://bugzilla.mozilla.org/show_bug.cgi?id=1000514

http://www.securitytracker.com/id/1030619

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.mozilla.org/security/announce/2014/mfsa2014-60.html

http://secunia.com/advisories/60628

http://secunia.com/advisories/59760

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3