VulnerabilityAnalyzed
CVE-2013-1675
Mozilla Firefox Information Disclosure Vulnerability
KEVMEDIUM 6.5EPSS 6.70%
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 March 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 6.70% probability · 94th percentile
- CISA KEV
- Listed 3 March 2022 · due 24 March 2022
- Weakness
- CWE-665
- Affected
- mozilla/firefox · mozilla/thunderbird · mozilla/thunderbird esr · canonical/ubuntu linux · debian/debian linux · redhat/gluster storage server for on-premise · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux for ibm z systems · redhat/enterprise linux for ibm z systems eus · redhat/enterprise linux for power big endian · redhat/enterprise linux for power big endian eus · redhat/enterprise linux for scientific computing · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux server eus from rhui · redhat/enterprise linux workstation · opensuse/opensuse
- Source
- security@mozilla.org
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-1675
References
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0820.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0821.htmlThird Party Advisory
- http://www.debian.org/security/2013/dsa-2699Mailing List
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:165Broken Link
- http://www.mozilla.org/security/announce/2013/mfsa2013-47.htmlVendor Advisory
- http://www.securityfocus.com/bid/59858Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1822-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1823-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=866825Exploit, Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0820.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0821.htmlThird Party Advisory
- http://www.debian.org/security/2013/dsa-2699Mailing List
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:165Broken Link
- http://www.mozilla.org/security/announce/2013/mfsa2013-47.htmlVendor Advisory
- http://www.securityfocus.com/bid/59858Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1822-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1823-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=866825Exploit, Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.