Back to KEVs

CVE-2013-1675

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly...

Basic Information

CVE State
PUBLISHED
Reserved Date
February 13, 2013
Published Date
May 16, 2013
Last Updated
February 07, 2025
Vendor
Mozilla
Product
Firefox, Firefox ESR, Thunderbird, Thunderbird ESR
Description
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
Tags
cisa

CVSS Scores

CVSS v3.1

6.5 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVSS v2.0

4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

SSVC Information

Exploitation
active
Technical Impact
partial

Exploit Status

Exploited in the Wild
Yes (2022-03-03 00:00:00 UTC) Source

References

http://www.debian.org/security/2013/dsa-2699 http://www.mandriva.com/security/advisories?name=MDVSA-2013:165 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html https://bugzilla.mozilla.org/show_bug.cgi?id=866825 http://www.ubuntu.com/usn/USN-1823-1 http://rhn.redhat.com/errata/RHSA-2013-0821.html http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html http://www.mozilla.org/security/announce/2013/mfsa2013-47.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976 http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html http://rhn.redhat.com/errata/RHSA-2013-0820.html http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html http://www.securityfocus.com/bid/59858 http://www.ubuntu.com/usn/USN-1822-1

Known Exploited Vulnerability Information

Source Added Date
CISA 2022-03-03 00:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel