CVE-2013-0776
Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a…
Does this matter?
Lower severity and a low EPSS score (1.30%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script, as demonstrated by a phishing attack on an HTTPS site.
- CVSS 2.0
- 4.0 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:N
- EPSS
- 1.30% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295
- Affected
- mozilla/firefox · mozilla/seamonkey · mozilla/thunderbird · mozilla/thunderbird esr · opensuse/opensuse · redhat/enterprise linux aus · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux workstation · debian/debian linux · canonical/ubuntu linux
- Source
- security@mozilla.org
References
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0271.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0272.htmlThird Party Advisory
- http://www.debian.org/security/2013/dsa-2699Third Party Advisory
- http://www.mozilla.org/security/announce/2013/mfsa2013-27.htmlVendor Advisory
- http://www.ubuntu.com/usn/USN-1729-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1729-2Third Party Advisory
- http://www.ubuntu.com/usn/USN-1748-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=796475Issue Tracking, Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16666Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0271.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0272.htmlThird Party Advisory
- http://www.debian.org/security/2013/dsa-2699Third Party Advisory
- http://www.mozilla.org/security/announce/2013/mfsa2013-27.htmlVendor Advisory
- http://www.ubuntu.com/usn/USN-1729-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1729-2Third Party Advisory
- http://www.ubuntu.com/usn/USN-1748-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=796475Issue Tracking, Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16666Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.