CVE-2013-1670

EUVD-2013-1697
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
≤ 20.0.1
mozillafirefox
19.0
mozillafirefox
19.0.1
mozillafirefox
19.0.2
mozillafirefox
20.0
mozillafirefox
17.0
mozillafirefox
17.0.1
mozillafirefox
17.0.2
mozillafirefox
17.0.3
mozillafirefox
17.0.4
mozillafirefox
17.0.5
mozillathunderbird
𝑥
≤ 17.0.5
mozillathunderbird
17.0
mozillathunderbird
17.0.1
mozillathunderbird
17.0.2
mozillathunderbird
17.0.3
mozillathunderbird
17.0.4
mozillathunderbird_esr
17.0
mozillathunderbird_esr
17.0.1
mozillathunderbird_esr
17.0.2
mozillathunderbird_esr
17.0.3
mozillathunderbird_esr
17.0.4
mozillathunderbird_esr
17.0.5
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
lucid
ignored
precise
Fixed 21.0+build1-0ubuntu0.12.04.3
released
quantal
Fixed 21.0+build1-0ubuntu0.12.10.2
released
raring
Fixed 21.0+build1-0ubuntu0.12.04.2
released
seamonkey
lucid
ignored
precise
dne
quantal
dne
raring
dne
thunderbird
lucid
ignored
precise
Fixed 17.0.6+build1-0ubuntu0.12.04.1
released
quantal
Fixed 17.0.6+build1-0ubuntu0.12.10.1
released
raring
Fixed 17.0.6+build1-0ubuntu0.13.04.1
released
xulrunner-1.9.2
lucid
ignored
precise
dne
quantal
dne
raring
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html
http://rhn.redhat.com/errata/RHSA-2013-0820.html
http://rhn.redhat.com/errata/RHSA-2013-0821.html
http://www.debian.org/security/2013/dsa-2699
http://www.exploit-db.com/exploits/34363
http://www.mandriva.com/security/advisories?name=MDVSA-2013:165
http://www.mozilla.org/security/announce/2013/mfsa2013-42.html
http://www.osvdb.org/93427
http://www.securityfocus.com/bid/59865
http://www.ubuntu.com/usn/USN-1822-1
http://www.ubuntu.com/usn/USN-1823-1
https://bugzilla.mozilla.org/show_bug.cgi?id=853709
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17046
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html
http://rhn.redhat.com/errata/RHSA-2013-0820.html
http://rhn.redhat.com/errata/RHSA-2013-0821.html
http://www.debian.org/security/2013/dsa-2699
http://www.exploit-db.com/exploits/34363
http://www.mandriva.com/security/advisories?name=MDVSA-2013:165
http://www.mozilla.org/security/announce/2013/mfsa2013-42.html
http://www.osvdb.org/93427
http://www.securityfocus.com/bid/59865
http://www.ubuntu.com/usn/USN-1822-1
http://www.ubuntu.com/usn/USN-1823-1
https://bugzilla.mozilla.org/show_bug.cgi?id=853709
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17046