[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2013-1687Date: (C)2013-06-25   (M)2024-03-27


The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 9.3
Exploit Score: 8.6
Impact Score: 10.0
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: COMPLETE
Integrity: COMPLETE
Availability: COMPLETE
  
Reference:
BID-60777
DSA-2716
DSA-2720
IAVM:2013-A-0125
RHSA-2013:0981
RHSA-2013:0982
SUSE-SU-2013:1152
SUSE-SU-2013:1153
USN-1890-1
USN-1891-1
http://www.mozilla.org/security/announce/2013/mfsa2013-51.html
https://bugzilla.mozilla.org/show_bug.cgi?id=863933
https://bugzilla.mozilla.org/show_bug.cgi?id=866823
openSUSE-SU-2013:1140
openSUSE-SU-2013:1141
openSUSE-SU-2013:1142
openSUSE-SU-2013:1143
oval:org.mitre.oval:def:17117

CPE    27
cpe:/a:mozilla:firefox_esr:17.0
cpe:/a:mozilla:firefox:20.0.1
cpe:/a:mozilla:firefox:19.0
cpe:/a:mozilla:thunderbird:17.0
...
CWE    1
CWE-264
OVAL    20
oval:org.secpod.oval:def:16314
oval:org.secpod.oval:def:501083
oval:org.secpod.oval:def:202911
oval:org.secpod.oval:def:601064
...

© SecPod Technologies