Log in Start free

Actively exploited · Published May 16, 2013 · Assigned by mozilla

CVE-2013-1675

Medium 6.5 Exploited

In plain English

A medium-severity security flaw in Firefox from Mozilla. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 6.7% (higher than 94% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)6.7%top 6.1% of all CVEs
Exploited in the wildYesCISA KEV since Mar 3, 2022
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 24, 2022.

Official description

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-665 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References