NetSight
IP …
critical9.3Public exploit code

CVE-2013-0757

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x …

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.

Affected products

VendorProductAffected versions
MozillaFirefox
before 17.0.2
before 18.0
MozillaSeamonkey
before 2.15
MozillaThunderbird
before 17.0.2
MozillaThunderbird Esr
before 17.0.2
OpensuseOpensuse
Versions 11.4, 12.1, 12.2
SuseLinux Enterprise Desktop
Versions 10, 11
SuseLinux Enterprise Server
Versions 10, 11
SuseLinux Enterprise Software Development Kit
Versions 10, 11
CanonicalUbuntu Linux
Versions 10.04, 11.10, 12.04, 12.10

Weakness classification

CWE-20

References