{"id":"CVE-2013-1690","url":"https://www.cyber-defence.io/tools/cve/CVE-2013-1690","generatedAt":"2026-10-31T23:41:08.486Z","title":"Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability","description":"Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.","published":"2013-06-26T03:19:11.000Z","lastModified":"2026-06-16T23:51:56.000Z","status":"Analyzed","sourceIdentifier":"security@mozilla.org","cvss":{"version":"3.1","score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"cwe":["CWE-119"],"affected":["mozilla/firefox","mozilla/thunderbird","mozilla/thunderbird esr","canonical/ubuntu linux","debian/debian linux","redhat/gluster storage server for on-premise","redhat/enterprise linux desktop","redhat/enterprise linux eus","redhat/enterprise linux server","redhat/enterprise linux server aus","redhat/enterprise linux workstation","opensuse/opensuse","suse/linux enterprise desktop","suse/linux enterprise server","suse/linux enterprise software development kit"],"epss":{"score":0.69021,"percentile":0.9935,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2022-03-28","dueDate":"2022-04-18","knownRansomwareCampaignUse":"Unknown","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-1690"},"exploits":{"count":1,"verified":true,"firstPublished":"2013-08-08","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":27429,"kind":"exploit","title":"Mozilla Firefox - onreadystatechange Event DocumentViewerImpl Use-After-Free (Metasploit)","url":"https://www.exploit-db.com/exploits/27429","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/27429.rb","file":"exploits/windows/remote/27429.rb","published":"2013-08-08","added":"2013-08-08","updated":"2013-08-08","author":"Metasploit","type":"remote","platform":"windows","port":null,"verified":true,"codes":["CVE-2013-1690","OSVDB-94584"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 18 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0981.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0982.html","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2013/dsa-2716","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.debian.org/security/2013/dsa-2720","tags":["Mailing List","Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-53.html","tags":["Vendor Advisory"],"source":"security@mozilla.org"},{"url":"http://www.securityfocus.com/bid/60778","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-1890-1","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"http://www.ubuntu.com/usn/USN-1891-1","tags":["Third Party Advisory"],"source":"security@mozilla.org"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=857883","tags":["Issue Tracking"],"source":"security@mozilla.org"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=901365","tags":["Issue Tracking"],"source":"security@mozilla.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996","tags":["Broken Link"],"source":"security@mozilla.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0981.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0982.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2013/dsa-2716","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2013/dsa-2720","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-53.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/60778","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-1890-1","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-1891-1","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=857883","tags":["Issue Tracking"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=901365","tags":["Issue Tracking"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1690","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-1690","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}