Log in Start free

Actively exploited · Published Jun 26, 2013 · Assigned by mozilla

CVE-2013-1690

High 8.8 Exploited

In plain English

A high-severity memory corruption in Firefox and Thunderbird from Mozilla. Attackers are actively exploiting it in the wild (listed by CISA on March 28, 2022). The chance it is exploited in the next 30 days is estimated at 69.0% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)69.0%top 0.6% of all CVEs
Exploited in the wildYesCISA KEV since Mar 28, 2022
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 18, 2022.

Official description

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References