CVE-2014-1561 | Vulnerability Database | Aqua Security

Mozilla Firefox before 31.0 does not properly restrict use of drag-and-drop events to spoof customization events, which allows remote attackers to alter the placement of UI icons via crafted JavaScript code that is encountered during (1) page, (2) panel, or (3) toolbar customization.

Affected Software

Name	Vendor	Start Version	End Version
Firefox	Mozilla	*	30.0 (including)
Firefox	Ubuntu	devel	*
Firefox	Ubuntu	lucid	*
Firefox	Ubuntu	precise	*
Firefox	Ubuntu	trusty	*
Firefox	Ubuntu	upstream	*

References

http://secunia.com/advisories/59760
http://secunia.com/advisories/60628
http://www.mozilla.org/security/announce/2014/mfsa2014-60.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securitytracker.com/id/1030619
https://bugzilla.mozilla.org/show_bug.cgi?id=1000514
https://bugzilla.mozilla.org/show_bug.cgi?id=910375
https://security.gentoo.org/glsa/201504-01
http://secunia.com/advisories/59760
http://secunia.com/advisories/60628
http://www.mozilla.org/security/announce/2014/mfsa2014-60.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://www.securitytracker.com/id/1030619
https://bugzilla.mozilla.org/show_bug.cgi?id=1000514
https://bugzilla.mozilla.org/show_bug.cgi?id=910375
https://security.gentoo.org/glsa/201504-01

NVD	https://nvd.nist.gov/vuln/detail/CVE-2014-1561
CWE	https://cwe.mitre.org/data/definitions/264.html