NetSight
IP …
medium4.3Public exploit code

CVE-2013-1670

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 1…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Affected products

VendorProductAffected versions
MozillaFirefox
through 20.0.1
Versions 19.0, 19.0.1, 19.0.2, 20.0, 17.0
MozillaThunderbird
through 17.0.5
Versions 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4
MozillaThunderbird Esr
Versions 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4, 17.0.5

Weakness classification

CWE-79CWE-264

References