NetSight
IP …
high8.8Known exploitedPublic exploit code

CVE-2013-1690

Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-28. Federal due date: 2022-04-18.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

Affected products

VendorProductAffected versions
MozillaFirefox
before 22.0
from 17.0 before 17.0.7
MozillaThunderbird
before 17.0.7
MozillaThunderbird Esr
from 17.0 before 17.0.7
CanonicalUbuntu Linux
Versions 12.04, 12.10, 13.04
DebianDebian Linux
Version 7.0
RedhatGluster Storage Server For On-Premise
Version 2.0
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0
RedhatEnterprise Linux Eus
Versions 5.9, 6.4
RedhatEnterprise Linux Server
Versions 5.0, 6.0
RedhatEnterprise Linux Server Aus
Versions 5.9, 6.4
RedhatEnterprise Linux Workstation
Versions 5.0, 6.0
OpensuseOpensuse
Versions 11.4, 12.2, 12.3

Weakness classification

CWE-119

References