CVE-2013-5618

EUVD-2013-5458
Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code by triggering improper garbage collection.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 93%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
< 26.0
mozillafirefox
24.0 ≤
𝑥
< 24.2
mozillaseamonkey
𝑥
< 2.23
mozillathunderbird
𝑥
< 24.2
susesuse_linux_enterprise_software_development_kit
11.0:sp3
opensuseopensuse
12.2
opensuseopensuse
12.3
opensuseopensuse
13.1
canonicalubuntu_linux
12.04
canonicalubuntu_linux
12.10
canonicalubuntu_linux
13.04
canonicalubuntu_linux
13.10
redhatenterprise_linux_desktop
5.0
redhatenterprise_linux_desktop
6.0
redhatenterprise_linux_eus
6.5
redhatenterprise_linux_server
5.0
redhatenterprise_linux_server
6.0
redhatenterprise_linux_server_aus
6.5
redhatenterprise_linux_server_eus
6.5
redhatenterprise_linux_server_tus
6.5
redhatenterprise_linux_workstation
5.0
redhatenterprise_linux_workstation
6.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
lucid
ignored
precise
Fixed 26.0+build2-0ubuntu0.12.04.2
released
quantal
Fixed 26.0+build2-0ubuntu0.12.10.2
released
raring
Fixed 26.0+build2-0ubuntu0.13.04.2
released
saucy
Fixed 26.0+build2-0ubuntu0.13.10.2
released
thunderbird
lucid
ignored
precise
Fixed 1:24.2.0+build1-0ubuntu0.12.04.1
released
quantal
Fixed 1:24.2.0+build1-0ubuntu0.12.10.1
released
raring
Fixed 1:24.2.0+build1-0ubuntu0.13.04.1
released
saucy
Fixed 1:24.2.0+build1-0ubuntu0.13.10.1
released
References