CVE-2014-1561

Publication date 22 July 2014

Last updated 24 July 2024

Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
firefox	14.04 LTS trusty	Fixed 31.0+build1-0ubuntu0.14.04.1
	12.04 LTS precise	Fixed 31.0+build1-0ubuntu0.12.04.1
	10.04 LTS lucid	Ignored end of life

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-2295-1
Firefox vulnerabilities
22 July 2014

Other references

https://www.mozilla.org/security/announce/2014/mfsa2014-60.html
https://www.cve.org/CVERecord?id=CVE-2014-1561