Vulnerability Details : CVE-2013-1674
Use-after-free vulnerability in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code via vectors involving an onresize event during the playing of a video.
Vulnerability category: Memory CorruptionExecute code
Products affected by CVE-2013-1674
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:17.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.5:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2013-1674
6.92%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2013-1674
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2013-1674
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-1674
-
http://www.ubuntu.com/usn/USN-1823-1
USN-1823-1: Thunderbird vulnerabilities | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html
[security-announce] openSUSE-SU-2013:0946-1: important: MozillaFirefox:
-
http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html
[security-announce] openSUSE-SU-2013:0929-1: important: xulrunner to 17.
-
http://www.securityfocus.com/bid/59859
Mozilla Firefox/Thunderbird CVE-2013-1674 Remote Code Execution Vulnerability
-
https://bugzilla.mozilla.org/show_bug.cgi?id=860971
860971 - (CVE-2013-1674) UAF with video and onresize event
-
http://rhn.redhat.com/errata/RHSA-2013-0820.html
RHSA-2013:0820 - Security Advisory - Red Hat Customer Portal
-
http://www.mandriva.com/security/advisories?name=MDVSA-2013:165
mandriva.com
-
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html
[security-announce] openSUSE-SU-2013:0825-1: important: MozillaFirefox:
-
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html
[security-announce] openSUSE-SU-2013:0831-1: important: xulrunner to 17.
-
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html
[security-announce] openSUSE-SU-2013:0834-1: important: MozillaThunderbi
-
http://www.mozilla.org/security/announce/2013/mfsa2013-46.html
Use-after-free with video and onresize event — MozillaVendor Advisory
-
http://www.ubuntu.com/usn/USN-1822-1
USN-1822-1: Firefox vulnerabilities | Ubuntu security notices
-
http://www.debian.org/security/2013/dsa-2699
Debian -- Security Information -- DSA-2699-1 iceweasel
-
http://rhn.redhat.com/errata/RHSA-2013-0821.html
RHSA-2013:0821 - Security Advisory - Red Hat Customer Portal
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17147
Repository / Oval Repository
Jump to