ID CVE-2013-1720
Summary The nsHtml5TreeBuilder::resetTheInsertionMode function in the HTML5 Tree Builder in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 does not properly maintain the state of the insertion-mode stack for template elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer over-read) by triggering use of this stack in its empty state.
References
Vulnerable Configurations
  • Mozilla Firefox 19.0.2
    cpe:2.3:a:mozilla:firefox:19.0.2
  • Mozilla Firefox 19.0.1
    cpe:2.3:a:mozilla:firefox:19.0.1
  • Mozilla Firefox 19.0
    cpe:2.3:a:mozilla:firefox:19.0
  • Mozilla Firefox 22.0
    cpe:2.3:a:mozilla:firefox:22.0
  • Mozilla Firefox 21.0
    cpe:2.3:a:mozilla:firefox:21.0
  • Mozilla Firefox 20.0.1
    cpe:2.3:a:mozilla:firefox:20.0.1
  • Mozilla Firefox 20.0
    cpe:2.3:a:mozilla:firefox:20.0
  • Mozilla Firefox 23.0.1
    cpe:2.3:a:mozilla:firefox:23.0.1
  • Mozilla Firefox 23.0
    cpe:2.3:a:mozilla:firefox:23.0
  • Mozilla Thunderbird 17.0
    cpe:2.3:a:mozilla:thunderbird:17.0
  • Mozilla Thunderbird 17.0.1
    cpe:2.3:a:mozilla:thunderbird:17.0.1
  • Mozilla Thunderbird 17.0.2
    cpe:2.3:a:mozilla:thunderbird:17.0.2
  • Mozilla Thunderbird 17.0.3
    cpe:2.3:a:mozilla:thunderbird:17.0.3
  • Mozilla Thunderbird 17.0.4
    cpe:2.3:a:mozilla:thunderbird:17.0.4
  • Mozilla Thunderbird 17.0.5
    cpe:2.3:a:mozilla:thunderbird:17.0.5
  • Mozilla Thunderbird 17.0.6
    cpe:2.3:a:mozilla:thunderbird:17.0.6
  • Mozilla Thunderbird 17.0.7
    cpe:2.3:a:mozilla:thunderbird:17.0.7
  • Mozilla Thunderbird 17.0.8
    cpe:2.3:a:mozilla:thunderbird:17.0.8
  • Mozilla Thunderbird 17.0.9
    cpe:2.3:a:mozilla:thunderbird:17.0.9
  • Mozilla Seamonkey 2.14 beta5
    cpe:2.3:a:mozilla:seamonkey:2.14:beta5
  • Mozilla Seamonkey 2.14 beta4
    cpe:2.3:a:mozilla:seamonkey:2.14:beta4
  • Mozilla Seamonkey 2.14 beta3
    cpe:2.3:a:mozilla:seamonkey:2.14:beta3
  • Mozilla Seamonkey 2.14 beta2
    cpe:2.3:a:mozilla:seamonkey:2.14:beta2
  • Mozilla Seamonkey 2.14 beta1
    cpe:2.3:a:mozilla:seamonkey:2.14:beta1
  • Mozilla Seamonkey 2.14
    cpe:2.3:a:mozilla:seamonkey:2.14
  • Mozilla Seamonkey 2.13.2
    cpe:2.3:a:mozilla:seamonkey:2.13.2
  • Mozilla SeaMonkey 2.13.1
    cpe:2.3:a:mozilla:seamonkey:2.13.1
  • Mozilla SeaMonkey 2.13 beta6
    cpe:2.3:a:mozilla:seamonkey:2.13:beta6
  • Mozilla SeaMonkey 2.13 beta5
    cpe:2.3:a:mozilla:seamonkey:2.13:beta5
  • Mozilla SeaMonkey 2.13 beta4
    cpe:2.3:a:mozilla:seamonkey:2.13:beta4
  • Mozilla SeaMonkey 2.13 beta3
    cpe:2.3:a:mozilla:seamonkey:2.13:beta3
  • Mozilla SeaMonkey 2.13 beta2
    cpe:2.3:a:mozilla:seamonkey:2.13:beta2
  • Mozilla SeaMonkey 2.13 beta1
    cpe:2.3:a:mozilla:seamonkey:2.13:beta1
  • Mozilla SeaMonkey 2.13
    cpe:2.3:a:mozilla:seamonkey:2.13
  • Mozilla SeaMonkey 2.12.1
    cpe:2.3:a:mozilla:seamonkey:2.12.1
  • Mozilla SeaMonkey 2.12 beta6
    cpe:2.3:a:mozilla:seamonkey:2.12:beta6
  • Mozilla SeaMonkey 2.12 beta5
    cpe:2.3:a:mozilla:seamonkey:2.12:beta5
  • Mozilla SeaMonkey 2.12 beta4
    cpe:2.3:a:mozilla:seamonkey:2.12:beta4
  • Mozilla SeaMonkey 2.12 beta3
    cpe:2.3:a:mozilla:seamonkey:2.12:beta3
  • Mozilla SeaMonkey 2.12 beta2
    cpe:2.3:a:mozilla:seamonkey:2.12:beta2
  • Mozilla SeaMonkey 2.12 beta1
    cpe:2.3:a:mozilla:seamonkey:2.12:beta1
  • Mozilla SeaMonkey 2.12
    cpe:2.3:a:mozilla:seamonkey:2.12
  • Mozilla SeaMonkey 2.11 beta6
    cpe:2.3:a:mozilla:seamonkey:2.11:beta6
  • Mozilla SeaMonkey 2.11 beta5
    cpe:2.3:a:mozilla:seamonkey:2.11:beta5
  • Mozilla SeaMonkey 2.11 beta4
    cpe:2.3:a:mozilla:seamonkey:2.11:beta4
  • Mozilla SeaMonkey 2.11 beta3
    cpe:2.3:a:mozilla:seamonkey:2.11:beta3
  • Mozilla SeaMonkey 2.11 beta2
    cpe:2.3:a:mozilla:seamonkey:2.11:beta2
  • Mozilla SeaMonkey 2.11 beta1
    cpe:2.3:a:mozilla:seamonkey:2.11:beta1
  • Mozilla SeaMonkey 2.11
    cpe:2.3:a:mozilla:seamonkey:2.11
  • Mozilla SeaMonkey 2.10.1
    cpe:2.3:a:mozilla:seamonkey:2.10.1
  • Mozilla SeaMonkey 2.10 beta3
    cpe:2.3:a:mozilla:seamonkey:2.10:beta3
  • Mozilla SeaMonkey 2.10 beta2
    cpe:2.3:a:mozilla:seamonkey:2.10:beta2
  • Mozilla SeaMonkey 2.10 beta1
    cpe:2.3:a:mozilla:seamonkey:2.10:beta1
  • Mozilla SeaMonkey 2.10
    cpe:2.3:a:mozilla:seamonkey:2.10
  • Mozilla SeaMonkey 2.1 Release Candidate 2
    cpe:2.3:a:mozilla:seamonkey:2.1:rc2
  • Mozilla SeaMonkey 2.1 Release Candidate 1
    cpe:2.3:a:mozilla:seamonkey:2.1:rc1
  • Mozilla SeaMonkey 2.1 Beta 3
    cpe:2.3:a:mozilla:seamonkey:2.1:beta3
  • Mozilla SeaMonkey 2.1 Beta 2
    cpe:2.3:a:mozilla:seamonkey:2.1:beta2
  • Mozilla SeaMonkey 2.1 Beta 1
    cpe:2.3:a:mozilla:seamonkey:2.1:beta1
  • Mozilla SeaMonkey 2.1 alpha3
    cpe:2.3:a:mozilla:seamonkey:2.1:alpha3
  • Mozilla SeaMonkey 2.1 alpha2
    cpe:2.3:a:mozilla:seamonkey:2.1:alpha2
  • Mozilla SeaMonkey 2.1 alpha1
    cpe:2.3:a:mozilla:seamonkey:2.1:alpha1
  • Mozilla SeaMonkey 2.1
    cpe:2.3:a:mozilla:seamonkey:2.1
  • Mozilla SeaMonkey 2.0.9
    cpe:2.3:a:mozilla:seamonkey:2.0.9
  • Mozilla SeaMonkey 2.0.8
    cpe:2.3:a:mozilla:seamonkey:2.0.8
  • Mozilla SeaMonkey 2.0.7
    cpe:2.3:a:mozilla:seamonkey:2.0.7
  • Mozilla SeaMonkey 2.0.6
    cpe:2.3:a:mozilla:seamonkey:2.0.6
  • Mozilla SeaMonkey 2.0.5
    cpe:2.3:a:mozilla:seamonkey:2.0.5
  • Mozilla SeaMonkey 2.0.4
    cpe:2.3:a:mozilla:seamonkey:2.0.4
  • Mozilla SeaMonkey 2.0.3
    cpe:2.3:a:mozilla:seamonkey:2.0.3
  • Mozilla SeaMonkey 2.0.2
    cpe:2.3:a:mozilla:seamonkey:2.0.2
  • Mozilla SeaMonkey 2.0.14
    cpe:2.3:a:mozilla:seamonkey:2.0.14
  • Mozilla SeaMonkey 2.0.13
    cpe:2.3:a:mozilla:seamonkey:2.0.13
  • Mozilla SeaMonkey 2.0.12
    cpe:2.3:a:mozilla:seamonkey:2.0.12
  • Mozilla SeaMonkey 2.0.11
    cpe:2.3:a:mozilla:seamonkey:2.0.11
  • Mozilla SeaMonkey 2.0.10
    cpe:2.3:a:mozilla:seamonkey:2.0.10
  • Mozilla SeaMonkey 2.0.1
    cpe:2.3:a:mozilla:seamonkey:2.0.1
  • Mozilla SeaMonkey 2.0 RC2
    cpe:2.3:a:mozilla:seamonkey:2.0:rc2
  • Mozilla SeaMonkey 2.0 RC1
    cpe:2.3:a:mozilla:seamonkey:2.0:rc1
  • Mozilla SeaMonkey 2.0 Beta 2
    cpe:2.3:a:mozilla:seamonkey:2.0:beta_2
  • Mozilla SeaMonkey 2.0 Beta 1
    cpe:2.3:a:mozilla:seamonkey:2.0:beta_1
  • Mozilla SeaMonkey 2.0 Alpha 3
    cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3
  • Mozilla SeaMonkey 2.0 Alpha 2
    cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2
  • Mozilla SeaMonkey 2.0 Alpha 1
    cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1
  • Mozilla SeaMonkey 2.0
    cpe:2.3:a:mozilla:seamonkey:2.0
  • Mozilla SeaMonkey 2.20 beta3
    cpe:2.3:a:mozilla:seamonkey:2.20:beta3
  • Mozilla SeaMonkey 2.20 beta2
    cpe:2.3:a:mozilla:seamonkey:2.20:beta2
  • Mozilla SeaMonkey 2.20 beta1
    cpe:2.3:a:mozilla:seamonkey:2.20:beta1
  • Mozilla SeaMonkey 2.20
    cpe:2.3:a:mozilla:seamonkey:2.20
  • Mozilla SeaMonkey 2.19 beta2
    cpe:2.3:a:mozilla:seamonkey:2.19:beta2
  • Mozilla SeaMonkey 2.19 beta1
    cpe:2.3:a:mozilla:seamonkey:2.19:beta1
  • Mozilla SeaMonkey 2.19
    cpe:2.3:a:mozilla:seamonkey:2.19
  • Mozilla SeaMonkey 2.18 beta4
    cpe:2.3:a:mozilla:seamonkey:2.18:beta4
  • Mozilla SeaMonkey 2.18 beta3
    cpe:2.3:a:mozilla:seamonkey:2.18:beta3
  • Mozilla SeaMonkey 2.18 beta2
    cpe:2.3:a:mozilla:seamonkey:2.18:beta2
  • Mozilla SeaMonkey 2.18 beta1
    cpe:2.3:a:mozilla:seamonkey:2.18:beta1
  • Mozilla SeaMonkey 2.17.1
    cpe:2.3:a:mozilla:seamonkey:2.17.1
  • Mozilla Seamonkey 2.17 beta4
    cpe:2.3:a:mozilla:seamonkey:2.17:beta4
  • Mozilla Seamonkey 2.17 beta3
    cpe:2.3:a:mozilla:seamonkey:2.17:beta3
  • Mozilla Seamonkey 2.17 beta2
    cpe:2.3:a:mozilla:seamonkey:2.17:beta2
  • Mozilla Seamonkey 2.17 beta1
    cpe:2.3:a:mozilla:seamonkey:2.17:beta1
  • Mozilla Seamonkey 2.17
    cpe:2.3:a:mozilla:seamonkey:2.17
  • Mozilla Seamonkey 2.16.2
    cpe:2.3:a:mozilla:seamonkey:2.16.2
  • Mozilla Seamonkey 2.16.1
    cpe:2.3:a:mozilla:seamonkey:2.16.1
  • Mozilla Seamonkey 2.16 beta5
    cpe:2.3:a:mozilla:seamonkey:2.16:beta5
  • Mozilla Seamonkey 2.16 beta4
    cpe:2.3:a:mozilla:seamonkey:2.16:beta4
  • Mozilla Seamonkey 2.16 beta3
    cpe:2.3:a:mozilla:seamonkey:2.16:beta3
  • Mozilla Seamonkey 2.16 beta2
    cpe:2.3:a:mozilla:seamonkey:2.16:beta2
  • Mozilla Seamonkey 2.16 beta1
    cpe:2.3:a:mozilla:seamonkey:2.16:beta1
  • Mozilla Seamonkey 2.16
    cpe:2.3:a:mozilla:seamonkey:2.16
  • Mozilla Seamonkey 2.15.2
    cpe:2.3:a:mozilla:seamonkey:2.15.2
  • Mozilla Seamonkey 2.15.1
    cpe:2.3:a:mozilla:seamonkey:2.15.1
  • Mozilla Seamonkey 2.15 beta6
    cpe:2.3:a:mozilla:seamonkey:2.15:beta6
  • Mozilla Seamonkey 2.15 beta5
    cpe:2.3:a:mozilla:seamonkey:2.15:beta5
  • Mozilla Seamonkey 2.15 beta4
    cpe:2.3:a:mozilla:seamonkey:2.15:beta4
  • Mozilla Seamonkey 2.15 beta3
    cpe:2.3:a:mozilla:seamonkey:2.15:beta3
  • Mozilla Seamonkey 2.15 beta2
    cpe:2.3:a:mozilla:seamonkey:2.15:beta2
  • Mozilla Seamonkey 2.15 beta1
    cpe:2.3:a:mozilla:seamonkey:2.15:beta1
  • Mozilla Seamonkey 2.15
    cpe:2.3:a:mozilla:seamonkey:2.15
CVSS
Base: 6.8 (as of 18-09-2013 - 06:19)
Impact:
Exploitability:
CWE CWE-119
CAPEC
  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
  • Overflow Binary Resource File
    An attack of this type exploits a buffer overflow vulnerability in the handling of binary resources. Binary resources may include music files like MP3, image files like JPEG files, and any other binary file. These attacks may pass unnoticed to the client machine through normal usage of files, such as a browser loading a seemingly innocent JPEG file. This can allow the attacker access to the execution stack and execute arbitrary code in the target process. This attack pattern is a variant of standard buffer overflow attacks using an unexpected vector (binary files) to wrap its attack and open up a new attack vector. The attacker is required to either directly serve the binary content to the victim, or place it in a locale like a MP3 sharing application, for the victim to download. The attacker then is notified upon the download or otherwise locates the vulnerability opened up by the buffer overflow.
  • Buffer Overflow via Symbolic Links
    This type of attack leverages the use of symbolic links to cause buffer overflows. An attacker can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.
  • Overflow Variables and Tags
    This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The attacker crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.
  • Buffer Overflow via Parameter Expansion
    In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
  • Buffer Overflow in an API Call
    This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An attacker who has access to an API may try to embed malicious code in the API function call and exploit a buffer overflow vulnerability in the function's implementation. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.
  • Buffer Overflow in Local Command-Line Utilities
    This attack targets command-line utilities available in a number of shells. An attacker can leverage a vulnerability found in a command-line utility to escalate privilege to root.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201309-23.NASL
    description The remote host is affected by the vulnerability described in GLSA-201309-23 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Further, a remote attacker could conduct XSS attacks, spoof URLs, bypass address space layout randomization, conduct clickjacking attacks, obtain potentially sensitive information, bypass access restrictions, modify the local filesystem, or conduct other unspecified attacks. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 70183
    published 2013-09-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70183
    title GLSA-201309-23 : Mozilla Products: Multiple vulnerabilities
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1952-1.NASL
    description Multiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1718) Atte Kettunen discovered a flaw in the HTML5 Tree Builder when interacting with template elements. If a user had scripting enabled, in some circumstances an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1720) Alex Chapman discovered an integer overflow vulnerability in the ANGLE library. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1721) Abhishek Arya discovered a use-after-free in the Animation Manager. If a user had scripting enabled, an attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1722) Scott Bell discovered a use-after-free when using a select element. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1724) It was discovered that the scope of new JavaScript objects could be accessed before their compartment is initialized. If a user had scripting enabled, an attacker could potentially exploit this to execute code with the privileges of the user invoking Thunderbird. (CVE-2013-1725) Dan Gohman discovered that some variables and data were used in IonMonkey, without being initialized, which could lead to information leakage. (CVE-2013-1728) Sachin Shinde discovered a crash when moving some XBL-backed nodes in to a document created by document.open(). If a user had scripting enabled, an attacker could potentially exploit this to cause a denial of service. (CVE-2013-1730) Aki Helin discovered a buffer overflow when combining lists, floats and multiple columns. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1732) Two memory corruption bugs when scrolling were discovered. If a user had scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1735, CVE-2013-1736) Boris Zbarsky discovered that user-defined getters on DOM proxies would use the expando object as 'this'. If a user had scripting enabled, an attacker could potentially exploit this by tricking add-on code in to making incorrect security sensitive decisions based on malicious values. (CVE-2013-1737) A use-after-free bug was discovered in Thunderbird. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1738). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 69970
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69970
    title Ubuntu 12.04 LTS / 12.10 / 13.04 : thunderbird vulnerabilities (USN-1952-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-17047.NASL
    description Upstream security update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 70205
    published 2013-09-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70205
    title Fedora 18 : firefox-24.0-1.fc18 / xulrunner-24.0-2.fc18 (2013-17047)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-719.NASL
    description This MozillaThunderbird update to version 24.0 fixes several security and non-security issues : - update to Thunderbird 24.0 (bnc#840485) - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong 'this' object - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC hazard with default compartments and frame chain restoration - moved greek to common translation package - require NSPR 4.10 and NSS 3.15.1 - add GStreamer build requirements for Gecko - added enigmail-build.patch to fix TB packaging (bmo#886095) - removed obsolete patches : - enigmail-old-gcc.patch - mozilla-gcc43-enums.patch - mozilla-gcc43-template_hacks.patch - mozilla-gcc43-templates_instantiation.patch - ppc-xpcshell.patch
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75150
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75150
    title openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2013:1495-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-17074.NASL
    description Upstream update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 70062
    published 2013-09-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70062
    title Fedora 20 : firefox-24.0-1.fc20 / xulrunner-24.0-2.fc20 (2013-17074)
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_24.NASL
    description The installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist that could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch can result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 69993
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69993
    title Firefox < 24.0 Multiple Vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_24.NASL
    description The installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by multiple vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments can result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker can exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch can result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This can result in access restrictions being bypassed. (CVE-2013-1737) - An issue in the NVIDIA OS X graphic drivers allows the user's desktop to be viewed by web content, potentially exposing sensitive information. (CVE-2013-1729)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 69989
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69989
    title Firefox < 24.0 Multiple Vulnerabilities (Mac OS X)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_THUNDERBIRD_24_0.NASL
    description The installed version of Thunderbird is a version prior to 24.0. It is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737) - An input validation error exists related to email messages containing HTML and iframes and the action of replying to or forwarding such messages that could allow cross-site scripting attacks. (CVE-2013-6674) - An input validation error exists related to email messages containing HTML and object or embed elements that could allow cross-site scripting attacks. (CVE-2014-2018)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 69991
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69991
    title Thunderbird 17.x through 23.x Multiple Vulnerabilities (Mac OS X)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-16992.NASL
    description Upstream security update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 70036
    published 2013-09-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70036
    title Fedora 19 : firefox-24.0-1.fc19 / xulrunner-24.0-2.fc19 (2013-16992)
  • NASL family Windows
    NASL id MOZILLA_THUNDERBIRD_24.NASL
    description The installed version of Thunderbird is 17.x or later but prior to 24. It is, therefore, potentially affected the following vulnerabilities: - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737) - An input validation error exists related to email messages containing HTML and iframes and the action of replying to or forwarding such messages that could allow cross-site scripting attacks. (CVE-2013-6674) - An input validation error exists related to email messages containing HTML and object or embed elements that could allow cross-site scripting attacks. (CVE-2014-2018)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 69995
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69995
    title Mozilla Thunderbird 17.x through 23.x Multiple Vulnerabilities
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_7DFED67B20AA11E3B8D80025905A4771.NASL
    description The Mozilla Project reports : MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9) MFSA 2013-77 Improper state in HTML5 Tree Builder with templates MFSA 2013-78 Integer overflow in ANGLE library MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed MFSA 2013-81 Use-after-free with select element MFSA 2013-82 Calling scope for new JavaScript objects can lead to memory corruption MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification MFSA 2013-84 Same-origin bypass through symbolic links MFSA 2013-85 Uninitialized data in IonMonkey MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers MFSA 2013-87 Shared object library loading from writable location MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes MFSA 2013-89 Buffer overflow with multi-column, lists, and floats MFSA 2013-90 Memory corruption involving scrolling MFSA 2013-91 User-defined properties on DOM proxies get the wrong 'this' object MFSA 2013-92 GC hazard with default compartments and frame chain restoration
    last seen 2019-02-21
    modified 2018-11-21
    plugin id 70262
    published 2013-10-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70262
    title FreeBSD : mozilla -- multiple vulnerabilities (7dfed67b-20aa-11e3-b8d8-0025905a4771)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-718.NASL
    description This MozillaFirefox update to version 24.0 fixes several security and non-security issues : - move greek to the translations-common package (bnc#840551) - update to Firefox 24.0 (bnc#840485) - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow in ANGLE library - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong 'this' object - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC hazard with default compartments and frame chain restoration - enable gstreamer explicitely via pref (gecko.js) - require NSS 3.15.1
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75149
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75149
    title openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1493-1)
  • NASL family Windows
    NASL id SEAMONKEY_221.NASL
    description The installed version of SeaMonkey is earlier than 2.21 and thus, is potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737)
    last seen 2019-02-21
    modified 2018-07-27
    plugin id 69996
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69996
    title SeaMonkey < 2.21 Multiple Vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-720.NASL
    description This seamonkey update to version 2.21 fixes several security and non-security issues : - update to SeaMonkey 2.21 (bnc#840485) - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow in ANGLE library - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong 'this' object - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC hazard with default compartments and frame chain restoration - requires NSS 3.15.1
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75151
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75151
    title openSUSE Security Update : seamonkey (openSUSE-SU-2013:1491-1)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1951-1.NASL
    description Multiple memory safety issues were discovered in Firefox. If a user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1718, CVE-2013-1719) Atte Kettunen discovered a flaw in the HTML5 Tree Builder when interacting with template elements. In some circumstances, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1720) Alex Chapman discovered an integer overflow vulnerability in the ANGLE library. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1721) Abhishek Arya discovered a use-after-free in the Animation Manager. An attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1722) Scott Bell discovered a use-after-free when using a select element. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1724) It was discovered that the scope of new JavaScript objects could be accessed before their compartment is initialized. An attacker could potentially exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2013-1725) Dan Gohman discovered that some variables and data were used in IonMonkey, without being initialized, which could lead to information leakage. (CVE-2013-1728) Sachin Shinde discovered a crash when moving some XBL-backed nodes in to a document created by document.open(). An attacker could potentially exploit this to cause a denial of service. (CVE-2013-1730) Aki Helin discovered a buffer overflow when combining lists, floats and multiple columns. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1732) Two memory corruption bugs when scrolling were discovered. An attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1735, CVE-2013-1736) Boris Zbarsky discovered that user-defined getters on DOM proxies would use the expando object as 'this'. An attacker could potentially exploit this by tricking add-on code in to making incorrect security sensitive decisions based on malicious values. (CVE-2013-1737) A use-after-free bug was discovered in Firefox. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1738). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 69947
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69947
    title Ubuntu 12.04 LTS / 12.10 / 13.04 : firefox vulnerabilities (USN-1951-1)
oval via4
accepted 2014-10-06T04:02:41.552-04:00
class vulnerability
contributors
  • name Shane Shaffer
    organization G2, Inc.
  • name Shane Shaffer
    organization G2, Inc.
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
  • name Richard Helbing
    organization baramundi software
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
definition_extensions
  • comment Mozilla Firefox Mainline release is installed
    oval oval:org.mitre.oval:def:22259
  • comment Mozilla Thunderbird Mainline release is installed
    oval oval:org.mitre.oval:def:22093
  • comment Mozilla Seamonkey is installed
    oval oval:org.mitre.oval:def:6372
description The nsHtml5TreeBuilder::resetTheInsertionMode function in the HTML5 Tree Builder in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 does not properly maintain the state of the insertion-mode stack for template elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer over-read) by triggering use of this stack in its empty state.
family windows
id oval:org.mitre.oval:def:18617
status accepted
submitted 2013-09-18T21:23:33.068-04:00
title The nsHtml5TreeBuilder::resetTheInsertionMode function in the HTML5 Tree Builder in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 does not properly maintain the state of the insertion-mode stack for template elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer over-read) by triggering use of this stack in its empty state.
version 36
refmap via4
bid 62465
confirm
fedora
  • FEDORA-2013-16992
  • FEDORA-2013-17047
  • FEDORA-2013-17074
suse
  • openSUSE-SU-2013:1491
  • openSUSE-SU-2013:1493
  • openSUSE-SU-2013:1495
  • openSUSE-SU-2013:1499
ubuntu
  • USN-1951-1
  • USN-1952-1
Last major update 06-01-2017 - 21:59
Published 18-09-2013 - 06:08
Last modified 18-09-2017 - 21:36
Back to Top