CVE-2014-1504: Mozilla Firefox

Low severity, CVSS 2.6. EPSS: 2.1% chance of exploitation in the next 30 days.

The session-restore feature in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not consider the Content Security Policy of a data: URL, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document that is accessed after a browser restart.

Affected products

• Mozilla Firefox: before 28.0 (fixed in 28.0)
• Mozilla Seamonkey: before 2.25 (fixed in 2.25)
• Opensuse Opensuse: version 11.4 only; version 12.3 only; version 13.1 only
• Oracle Solaris: version 11.3 only
• Suse Linux Enterprise Desktop: version 11 only
• Suse Linux Enterprise SDK: version 11 only
• Suse Linux Enterprise Server: version 11 only

Published 2014-03-19. Last modified 2026-06-17.