CVE-2014-8638: mozilla firefox Cross-Site Request Forgery (CSRF)

EPSS trend

Probability

1.02%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

0.00 pp

From 1.02% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.02%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

44 links

rhn.redhat.com/errata/RHSA-2015-0046.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/62242Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id/1031533VDB EntryX Refsource SECTRACK
www.ubuntu.com/usn/USN-2460-1Vendor AdvisoryX Refsource UBUNTU
www.securityfocus.com/bid/72047VDB EntryX Refsource BID
lists.opensuse.org/opensuse-security-announce/2015-02/msg00002.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/62304Third Party AdvisoryX Refsource SECUNIA
linux.oracle.com/errata/ELSA-2015-0047.htmlX Refsource CONFIRM
secunia.com/advisories/62259Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/62250Third Party AdvisoryX Refsource SECUNIA

Show all 44 references

lists.opensuse.org/opensuse-security-announce/2015-01/msg00033.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/62237Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2015-01/msg00014.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/62418Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2015-01/msg00032.htmlVendor AdvisoryX Refsource SUSE
bugzilla.mozilla.org/show_bug.cgi?id=1080987X Refsource CONFIRM
secunia.com/advisories/62316Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2015/dsa-3132Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/62274Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/201504-01Vendor AdvisoryX Refsource GENTOO
secunia.com/advisories/62313Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2015-0047.htmlVendor AdvisoryX Refsource REDHAT
www.mozilla.org/security/announce/2014/mfsa2015-03.htmlX Refsource CONFIRMVendor Advisory
secunia.com/advisories/62790Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/62293Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/62283Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/99958VDB EntryX Refsource XF
secunia.com/advisories/62446Third Party AdvisoryX Refsource SECUNIA
www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.htmlX Refsource CONFIRM
secunia.com/advisories/62657Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/62273Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-updates/2015-01/msg00071.htmlVendor AdvisoryX Refsource SUSE
lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.htmlVendor AdvisoryX Refsource SUSE
www.debian.org/security/2015/dsa-3127Vendor AdvisoryX Refsource DEBIAN
lists.opensuse.org/opensuse-security-announce/2015-01/msg00036.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/62315Third Party AdvisoryX Refsource SECUNIA
linux.oracle.com/errata/ELSA-2015-0046.htmlX Refsource CONFIRM
secunia.com/advisories/62253Third Party AdvisoryX Refsource SECUNIA
www.securitytracker.com/id/1031534VDB EntryX Refsource SECTRACK
ubuntu.com/security/CVE-2014-8638REPORT
www.mozilla.org/en-GB/security/advisories/mfsa2015-03/REPORT
ubuntu.com/security/notices/USN-2458-1Advisory
ubuntu.com/security/notices/USN-2460-1Advisory
www.cve.org/CVERecord?id=CVE-2014-8638REPORT

Related vulnerabilities

CVE-2013-1735mozillafirefox+34.73%13y ago18-09-2013 10:00Use-after-free vulnerability in the mozilla::layout::ScrollbarActivity function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via vectors related to image-document scrolling.CVE-2013-1718mozillafirefox+35.44%13y ago18-09-2013 10:00Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.CVE-2013-1717mozillafirefox+32.40%13y ago07-08-2013 01:00Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging a download to a fixed pathname or other predictable pathname.CVE-2013-1723mozillafirefox+21.80%13y ago18-09-2013 10:00The NativeKey widget in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 processes key messages after destruction by a dispatched event listener, which allows remote attackers to cause a denial of service (application crash) by leveraging incorrect event usage after widget-memory reallocation.CVE-2013-1713mozillafirefox+31.62%13y ago07-08-2013 01:00Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 use an incorrect URI within unspecified comparisons during enforcement of the Same Origin Policy, which allows remote attackers to conduct cross-site scripting (XSS) attacks or install arbitrary add-ons via a crafted web site.CVE-2013-1708mozillafirefox+13.18%13y ago07-08-2013 01:00Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allow remote attackers to cause a denial of service (application crash) via a crafted WAV file that is not properly handled by the nsCString::CharAt function.

All vulnerabilities infirefox firefox_esr seamonkey thunderbird

CVE-2014-8638: mozilla firefox Cross-Site Request Forgery (CSRF)

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References