VulnerabilityAnalyzed

CVE-2013-1690

Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

KEVHIGH 8.8EPSS 69.0%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 18 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 69.02% probability · 99th percentile
CISA KEV: Listed 28 March 2022 · due 18 April 2022
Weakness: CWE-119
Affected: mozilla/firefox · mozilla/thunderbird · mozilla/thunderbird esr · canonical/ubuntu linux · debian/debian linux · redhat/gluster storage server for on-premise · redhat/enterprise linux desktop · redhat/enterprise linux eus · redhat/enterprise linux server · redhat/enterprise linux server aus · redhat/enterprise linux workstation · opensuse/opensuse · suse/linux enterprise desktop · suse/linux enterprise server · suse/linux enterprise software development kit
Source: security@mozilla.org

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-1690

References

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0981.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0982.htmlThird Party Advisory
http://www.debian.org/security/2013/dsa-2716Mailing List, Third Party Advisory
http://www.debian.org/security/2013/dsa-2720Mailing List, Third Party Advisory
http://www.mozilla.org/security/announce/2013/mfsa2013-53.htmlVendor Advisory
http://www.securityfocus.com/bid/60778Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1890-1Third Party Advisory
http://www.ubuntu.com/usn/USN-1891-1Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=857883Issue Tracking
https://bugzilla.mozilla.org/show_bug.cgi?id=901365Issue Tracking
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996Broken Link
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0981.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0982.htmlThird Party Advisory
http://www.debian.org/security/2013/dsa-2716Mailing List, Third Party Advisory
http://www.debian.org/security/2013/dsa-2720Mailing List, Third Party Advisory
http://www.mozilla.org/security/announce/2013/mfsa2013-53.htmlVendor Advisory
http://www.securityfocus.com/bid/60778Broken Link, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-1890-1Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.