critical10.0Public exploit code
CVE-2013-1710
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before …
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Mozilla Firefox 5.0 < 15.0.1 - __exposedProps__ XCS Code Execution (Metasploit)2013-08-06 · local · multiple · Verified
Impact
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Seamonkey | through 2.20 Versions 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4 |
| Mozilla | Thunderbird Esr | Versions 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4, 17.0.5 |
| Mozilla | Firefox | through 22.0 Versions 19.0, 19.0.1, 19.0.2, 20.0, 20.0.1 |
| Mozilla | Thunderbird | through 17.0.7 Versions 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.debian.org/security/2013/dsa-2735
- http://www.debian.org/security/2013/dsa-2746
- http://www.mozilla.org/security/announce/2013/mfsa2013-69.html
- http://www.securityfocus.com/bid/61900
- https://bugzilla.mozilla.org/show_bug.cgi?id=871368
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18773
- http://www.debian.org/security/2013/dsa-2735
- http://www.debian.org/security/2013/dsa-2746
- http://www.mozilla.org/security/announce/2013/mfsa2013-69.html
- http://www.securityfocus.com/bid/61900
- https://bugzilla.mozilla.org/show_bug.cgi?id=871368
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18773