ID CVE-2013-1737
Summary Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object.
References
Vulnerable Configurations
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.7
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.7
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.6
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.6
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.5
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.5
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.4
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.4
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.3
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.3
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.2
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.2
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.1
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.1
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0
    cpe:2.3:a:mozilla:thunderbird_esr:17.0
  • Mozilla Thunderbird Extended Support Release (ESR) 17.0.8
    cpe:2.3:a:mozilla:thunderbird_esr:17.0.8
  • Mozilla Seamonkey 2.14 beta5
    cpe:2.3:a:mozilla:seamonkey:2.14:beta5
  • Mozilla Seamonkey 2.14 beta4
    cpe:2.3:a:mozilla:seamonkey:2.14:beta4
  • Mozilla Seamonkey 2.14 beta3
    cpe:2.3:a:mozilla:seamonkey:2.14:beta3
  • Mozilla Seamonkey 2.14 beta2
    cpe:2.3:a:mozilla:seamonkey:2.14:beta2
  • Mozilla Seamonkey 2.14 beta1
    cpe:2.3:a:mozilla:seamonkey:2.14:beta1
  • Mozilla Seamonkey 2.14
    cpe:2.3:a:mozilla:seamonkey:2.14
  • Mozilla Seamonkey 2.13.2
    cpe:2.3:a:mozilla:seamonkey:2.13.2
  • Mozilla SeaMonkey 2.13.1
    cpe:2.3:a:mozilla:seamonkey:2.13.1
  • Mozilla SeaMonkey 2.13 beta6
    cpe:2.3:a:mozilla:seamonkey:2.13:beta6
  • Mozilla SeaMonkey 2.13 beta5
    cpe:2.3:a:mozilla:seamonkey:2.13:beta5
  • Mozilla SeaMonkey 2.13 beta4
    cpe:2.3:a:mozilla:seamonkey:2.13:beta4
  • Mozilla SeaMonkey 2.13 beta3
    cpe:2.3:a:mozilla:seamonkey:2.13:beta3
  • Mozilla SeaMonkey 2.13 beta2
    cpe:2.3:a:mozilla:seamonkey:2.13:beta2
  • Mozilla SeaMonkey 2.13 beta1
    cpe:2.3:a:mozilla:seamonkey:2.13:beta1
  • Mozilla SeaMonkey 2.13
    cpe:2.3:a:mozilla:seamonkey:2.13
  • Mozilla SeaMonkey 2.12.1
    cpe:2.3:a:mozilla:seamonkey:2.12.1
  • Mozilla SeaMonkey 2.12 beta6
    cpe:2.3:a:mozilla:seamonkey:2.12:beta6
  • Mozilla SeaMonkey 2.12 beta5
    cpe:2.3:a:mozilla:seamonkey:2.12:beta5
  • Mozilla SeaMonkey 2.12 beta4
    cpe:2.3:a:mozilla:seamonkey:2.12:beta4
  • Mozilla SeaMonkey 2.12 beta3
    cpe:2.3:a:mozilla:seamonkey:2.12:beta3
  • Mozilla SeaMonkey 2.12 beta2
    cpe:2.3:a:mozilla:seamonkey:2.12:beta2
  • Mozilla SeaMonkey 2.12 beta1
    cpe:2.3:a:mozilla:seamonkey:2.12:beta1
  • Mozilla SeaMonkey 2.12
    cpe:2.3:a:mozilla:seamonkey:2.12
  • Mozilla SeaMonkey 2.11 beta6
    cpe:2.3:a:mozilla:seamonkey:2.11:beta6
  • Mozilla SeaMonkey 2.11 beta5
    cpe:2.3:a:mozilla:seamonkey:2.11:beta5
  • Mozilla SeaMonkey 2.11 beta4
    cpe:2.3:a:mozilla:seamonkey:2.11:beta4
  • Mozilla SeaMonkey 2.11 beta3
    cpe:2.3:a:mozilla:seamonkey:2.11:beta3
  • Mozilla SeaMonkey 2.11 beta2
    cpe:2.3:a:mozilla:seamonkey:2.11:beta2
  • Mozilla SeaMonkey 2.11 beta1
    cpe:2.3:a:mozilla:seamonkey:2.11:beta1
  • Mozilla SeaMonkey 2.11
    cpe:2.3:a:mozilla:seamonkey:2.11
  • Mozilla SeaMonkey 2.10.1
    cpe:2.3:a:mozilla:seamonkey:2.10.1
  • Mozilla SeaMonkey 2.10 beta3
    cpe:2.3:a:mozilla:seamonkey:2.10:beta3
  • Mozilla SeaMonkey 2.10 beta2
    cpe:2.3:a:mozilla:seamonkey:2.10:beta2
  • Mozilla SeaMonkey 2.10 beta1
    cpe:2.3:a:mozilla:seamonkey:2.10:beta1
  • Mozilla SeaMonkey 2.10
    cpe:2.3:a:mozilla:seamonkey:2.10
  • Mozilla SeaMonkey 2.1 Release Candidate 2
    cpe:2.3:a:mozilla:seamonkey:2.1:rc2
  • Mozilla SeaMonkey 2.1 Release Candidate 1
    cpe:2.3:a:mozilla:seamonkey:2.1:rc1
  • Mozilla SeaMonkey 2.1 Beta 3
    cpe:2.3:a:mozilla:seamonkey:2.1:beta3
  • Mozilla SeaMonkey 2.1 Beta 2
    cpe:2.3:a:mozilla:seamonkey:2.1:beta2
  • Mozilla SeaMonkey 2.1 Beta 1
    cpe:2.3:a:mozilla:seamonkey:2.1:beta1
  • Mozilla SeaMonkey 2.1 alpha3
    cpe:2.3:a:mozilla:seamonkey:2.1:alpha3
  • Mozilla SeaMonkey 2.1 alpha2
    cpe:2.3:a:mozilla:seamonkey:2.1:alpha2
  • Mozilla SeaMonkey 2.1 alpha1
    cpe:2.3:a:mozilla:seamonkey:2.1:alpha1
  • Mozilla SeaMonkey 2.1
    cpe:2.3:a:mozilla:seamonkey:2.1
  • Mozilla SeaMonkey 2.0.9
    cpe:2.3:a:mozilla:seamonkey:2.0.9
  • Mozilla SeaMonkey 2.0.8
    cpe:2.3:a:mozilla:seamonkey:2.0.8
  • Mozilla SeaMonkey 2.0.7
    cpe:2.3:a:mozilla:seamonkey:2.0.7
  • Mozilla SeaMonkey 2.0.6
    cpe:2.3:a:mozilla:seamonkey:2.0.6
  • Mozilla SeaMonkey 2.0.5
    cpe:2.3:a:mozilla:seamonkey:2.0.5
  • Mozilla SeaMonkey 2.0.4
    cpe:2.3:a:mozilla:seamonkey:2.0.4
  • Mozilla SeaMonkey 2.0.3
    cpe:2.3:a:mozilla:seamonkey:2.0.3
  • Mozilla SeaMonkey 2.0.2
    cpe:2.3:a:mozilla:seamonkey:2.0.2
  • Mozilla SeaMonkey 2.0.14
    cpe:2.3:a:mozilla:seamonkey:2.0.14
  • Mozilla SeaMonkey 2.0.13
    cpe:2.3:a:mozilla:seamonkey:2.0.13
  • Mozilla SeaMonkey 2.0.12
    cpe:2.3:a:mozilla:seamonkey:2.0.12
  • Mozilla SeaMonkey 2.0.11
    cpe:2.3:a:mozilla:seamonkey:2.0.11
  • Mozilla SeaMonkey 2.0.10
    cpe:2.3:a:mozilla:seamonkey:2.0.10
  • Mozilla SeaMonkey 2.0.1
    cpe:2.3:a:mozilla:seamonkey:2.0.1
  • Mozilla SeaMonkey 2.0 RC2
    cpe:2.3:a:mozilla:seamonkey:2.0:rc2
  • Mozilla SeaMonkey 2.0 RC1
    cpe:2.3:a:mozilla:seamonkey:2.0:rc1
  • Mozilla SeaMonkey 2.0 Beta 2
    cpe:2.3:a:mozilla:seamonkey:2.0:beta_2
  • Mozilla SeaMonkey 2.0 Beta 1
    cpe:2.3:a:mozilla:seamonkey:2.0:beta_1
  • Mozilla SeaMonkey 2.0 Alpha 3
    cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3
  • Mozilla SeaMonkey 2.0 Alpha 2
    cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2
  • Mozilla SeaMonkey 2.0 Alpha 1
    cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1
  • Mozilla SeaMonkey 2.0
    cpe:2.3:a:mozilla:seamonkey:2.0
  • Mozilla SeaMonkey 2.20 beta3
    cpe:2.3:a:mozilla:seamonkey:2.20:beta3
  • Mozilla SeaMonkey 2.20 beta2
    cpe:2.3:a:mozilla:seamonkey:2.20:beta2
  • Mozilla SeaMonkey 2.20 beta1
    cpe:2.3:a:mozilla:seamonkey:2.20:beta1
  • Mozilla SeaMonkey 2.20
    cpe:2.3:a:mozilla:seamonkey:2.20
  • Mozilla SeaMonkey 2.19 beta2
    cpe:2.3:a:mozilla:seamonkey:2.19:beta2
  • Mozilla SeaMonkey 2.19 beta1
    cpe:2.3:a:mozilla:seamonkey:2.19:beta1
  • Mozilla SeaMonkey 2.19
    cpe:2.3:a:mozilla:seamonkey:2.19
  • Mozilla SeaMonkey 2.18 beta4
    cpe:2.3:a:mozilla:seamonkey:2.18:beta4
  • Mozilla SeaMonkey 2.18 beta3
    cpe:2.3:a:mozilla:seamonkey:2.18:beta3
  • Mozilla SeaMonkey 2.18 beta2
    cpe:2.3:a:mozilla:seamonkey:2.18:beta2
  • Mozilla SeaMonkey 2.18 beta1
    cpe:2.3:a:mozilla:seamonkey:2.18:beta1
  • Mozilla SeaMonkey 2.17.1
    cpe:2.3:a:mozilla:seamonkey:2.17.1
  • Mozilla Seamonkey 2.17 beta4
    cpe:2.3:a:mozilla:seamonkey:2.17:beta4
  • Mozilla Seamonkey 2.17 beta3
    cpe:2.3:a:mozilla:seamonkey:2.17:beta3
  • Mozilla Seamonkey 2.17 beta2
    cpe:2.3:a:mozilla:seamonkey:2.17:beta2
  • Mozilla Seamonkey 2.17 beta1
    cpe:2.3:a:mozilla:seamonkey:2.17:beta1
  • Mozilla Seamonkey 2.17
    cpe:2.3:a:mozilla:seamonkey:2.17
  • Mozilla Seamonkey 2.16.2
    cpe:2.3:a:mozilla:seamonkey:2.16.2
  • Mozilla Seamonkey 2.16.1
    cpe:2.3:a:mozilla:seamonkey:2.16.1
  • Mozilla Seamonkey 2.16 beta5
    cpe:2.3:a:mozilla:seamonkey:2.16:beta5
  • Mozilla Seamonkey 2.16 beta4
    cpe:2.3:a:mozilla:seamonkey:2.16:beta4
  • Mozilla Seamonkey 2.16 beta3
    cpe:2.3:a:mozilla:seamonkey:2.16:beta3
  • Mozilla Seamonkey 2.16 beta2
    cpe:2.3:a:mozilla:seamonkey:2.16:beta2
  • Mozilla Seamonkey 2.16 beta1
    cpe:2.3:a:mozilla:seamonkey:2.16:beta1
  • Mozilla Seamonkey 2.16
    cpe:2.3:a:mozilla:seamonkey:2.16
  • Mozilla Seamonkey 2.15.2
    cpe:2.3:a:mozilla:seamonkey:2.15.2
  • Mozilla Seamonkey 2.15.1
    cpe:2.3:a:mozilla:seamonkey:2.15.1
  • Mozilla Seamonkey 2.15 beta6
    cpe:2.3:a:mozilla:seamonkey:2.15:beta6
  • Mozilla Seamonkey 2.15 beta5
    cpe:2.3:a:mozilla:seamonkey:2.15:beta5
  • Mozilla Seamonkey 2.15 beta4
    cpe:2.3:a:mozilla:seamonkey:2.15:beta4
  • Mozilla Seamonkey 2.15 beta3
    cpe:2.3:a:mozilla:seamonkey:2.15:beta3
  • Mozilla Seamonkey 2.15 beta2
    cpe:2.3:a:mozilla:seamonkey:2.15:beta2
  • Mozilla Seamonkey 2.15 beta1
    cpe:2.3:a:mozilla:seamonkey:2.15:beta1
  • Mozilla Seamonkey 2.15
    cpe:2.3:a:mozilla:seamonkey:2.15
  • Mozilla Firefox Extended Support Release (ESR) 17.0.8
    cpe:2.3:a:mozilla:firefox_esr:17.0.8
  • Mozilla Firefox Extended Support Release (ESR) 17.0.7
    cpe:2.3:a:mozilla:firefox_esr:17.0.7
  • Mozilla Firefox Extended Support Release (ESR) 17.0.6
    cpe:2.3:a:mozilla:firefox_esr:17.0.6
  • Mozilla Firefox Extended Support Release (ESR) 17.0.5
    cpe:2.3:a:mozilla:firefox_esr:17.0.5
  • Mozilla Firefox Extended Support Release (ESR) 17.0.4
    cpe:2.3:a:mozilla:firefox_esr:17.0.4
  • Mozilla Firefox Extended Support Release (ESR) 17.0.3
    cpe:2.3:a:mozilla:firefox_esr:17.0.3
  • Mozilla Firefox Extended Support Release (ESR) 17.0.2
    cpe:2.3:a:mozilla:firefox_esr:17.0.2
  • Mozilla Firefox Extended Support Release (ESR) 17.0.1
    cpe:2.3:a:mozilla:firefox_esr:17.0.1
  • Mozilla Firefox Extended Support Release (ESR) 17.0
    cpe:2.3:a:mozilla:firefox_esr:17.0
  • Mozilla Thunderbird 17.0
    cpe:2.3:a:mozilla:thunderbird:17.0
  • Mozilla Thunderbird 17.0.1
    cpe:2.3:a:mozilla:thunderbird:17.0.1
  • Mozilla Thunderbird 17.0.2
    cpe:2.3:a:mozilla:thunderbird:17.0.2
  • Mozilla Thunderbird 17.0.3
    cpe:2.3:a:mozilla:thunderbird:17.0.3
  • Mozilla Thunderbird 17.0.4
    cpe:2.3:a:mozilla:thunderbird:17.0.4
  • Mozilla Thunderbird 17.0.5
    cpe:2.3:a:mozilla:thunderbird:17.0.5
  • Mozilla Thunderbird 17.0.6
    cpe:2.3:a:mozilla:thunderbird:17.0.6
  • Mozilla Thunderbird 17.0.7
    cpe:2.3:a:mozilla:thunderbird:17.0.7
  • Mozilla Thunderbird 17.0.8
    cpe:2.3:a:mozilla:thunderbird:17.0.8
  • Mozilla Thunderbird 17.0.9
    cpe:2.3:a:mozilla:thunderbird:17.0.9
  • Mozilla Firefox 19.0.2
    cpe:2.3:a:mozilla:firefox:19.0.2
  • Mozilla Firefox 19.0.1
    cpe:2.3:a:mozilla:firefox:19.0.1
  • Mozilla Firefox 19.0
    cpe:2.3:a:mozilla:firefox:19.0
  • Mozilla Firefox 22.0
    cpe:2.3:a:mozilla:firefox:22.0
  • Mozilla Firefox 21.0
    cpe:2.3:a:mozilla:firefox:21.0
  • Mozilla Firefox 20.0.1
    cpe:2.3:a:mozilla:firefox:20.0.1
  • Mozilla Firefox 20.0
    cpe:2.3:a:mozilla:firefox:20.0
  • Mozilla Firefox 23.0.1
    cpe:2.3:a:mozilla:firefox:23.0.1
  • Mozilla Firefox 23.0
    cpe:2.3:a:mozilla:firefox:23.0
CVSS
Base: 5.0 (as of 18-09-2013 - 13:44)
Impact:
Exploitability:
CWE CWE-264
CAPEC
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
nessus via4
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201309-23.NASL
    description The remote host is affected by the vulnerability described in GLSA-201309-23 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Further, a remote attacker could conduct XSS attacks, spoof URLs, bypass address space layout randomization, conduct clickjacking attacks, obtain potentially sensitive information, bypass access restrictions, modify the local filesystem, or conduct other unspecified attacks. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 70183
    published 2013-09-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70183
    title GLSA-201309-23 : Mozilla Products: Multiple vulnerabilities
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1952-1.NASL
    description Multiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1718) Atte Kettunen discovered a flaw in the HTML5 Tree Builder when interacting with template elements. If a user had scripting enabled, in some circumstances an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1720) Alex Chapman discovered an integer overflow vulnerability in the ANGLE library. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1721) Abhishek Arya discovered a use-after-free in the Animation Manager. If a user had scripting enabled, an attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1722) Scott Bell discovered a use-after-free when using a select element. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1724) It was discovered that the scope of new JavaScript objects could be accessed before their compartment is initialized. If a user had scripting enabled, an attacker could potentially exploit this to execute code with the privileges of the user invoking Thunderbird. (CVE-2013-1725) Dan Gohman discovered that some variables and data were used in IonMonkey, without being initialized, which could lead to information leakage. (CVE-2013-1728) Sachin Shinde discovered a crash when moving some XBL-backed nodes in to a document created by document.open(). If a user had scripting enabled, an attacker could potentially exploit this to cause a denial of service. (CVE-2013-1730) Aki Helin discovered a buffer overflow when combining lists, floats and multiple columns. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1732) Two memory corruption bugs when scrolling were discovered. If a user had scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1735, CVE-2013-1736) Boris Zbarsky discovered that user-defined getters on DOM proxies would use the expando object as 'this'. If a user had scripting enabled, an attacker could potentially exploit this by tricking add-on code in to making incorrect security sensitive decisions based on malicious values. (CVE-2013-1737) A use-after-free bug was discovered in Thunderbird. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1738). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 69970
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69970
    title Ubuntu 12.04 LTS / 12.10 / 13.04 : thunderbird vulnerabilities (USN-1952-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_MOZILLAFIREFOX-130919.NASL
    description This update to Firefox 17.0.9esr (bnc#840485) addresses : - User-defined properties on DOM proxies get the wrong 'this' object. (MFSA 2013-91) -. (CVE-2013-1737) - Memory corruption involving scrolling. (MFSA 2013-90) - use-after-free in mozilla::layout::ScrollbarActivity. (CVE-2013-1735) - Memory corruption in nsGfxScrollFrameInner::IsLTR(). (CVE-2013-1736) - Buffer overflow with multi-column, lists, and floats. (MFSA 2013-89) - buffer overflow at nsFloatManager::GetFlowArea() with multicol, list, floats. (CVE-2013-1732) - compartment mismatch re-attaching XBL-backed nodes. (MFSA 2013-88) - compartment mismatch in nsXBLBinding::DoInitJSClass. (CVE-2013-1730) - Mozilla Updater does not lock MAR file after signature verification. (MFSA 2013-83) - MAR signature bypass in Updater could lead to downgrade. (CVE-2013-1726) - Calling scope for new JavaScript objects can lead to memory corruption. (MFSA 2013-82) - ABORT: bad scope for new JSObjects: ReparentWrapper / document.open. (CVE-2013-1725) - Use-after-free in Animation Manager during stylesheet cloning. (MFSA 2013-79) - Heap-use-after-free in nsAnimationManager::BuildAnimations. (CVE-2013-1722) - Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9). (MFSA 2013-76) - Memory safety bugs fixed in Firefox 17.0.9 and Firefox 24.0. (CVE-2013-1718) - Buffer underflow when generating CRMF requests. (MFSA 2013-65) - ASAN heap-buffer-overflow (read 1) in cryptojs_interpret_key_gen_type (CVE-2013-1705)
    last seen 2019-02-21
    modified 2014-05-22
    plugin id 70189
    published 2013-09-28
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70189
    title SuSE 11.2 / 11.3 Security Update : Mozilla Firefox (SAT Patch Numbers 8344 / 8346)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-819.NASL
    description MozillaFirefox was updated to Firefox 25.0. MozillaThunderbird was updated to Thunderbird 24.1.0. Mozilla XULRunner was updated to 17.0.10esr. Mozilla NSPR was updated to 4.10.1. Changes in MozillaFirefox : - requires NSS 3.15.2 or above - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards - MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions - MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache - MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass of PDF.js checks using iframes - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers - MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates Changes in MozillaThunderbird : - requires NSS 3.15.2 or above - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards - MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions - MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers - MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates - update to Thunderbird 24.0.1 - fqdn for smtp server name was not accepted (bmo#913785) - fixed crash in PL_strncasecmp (bmo#917955) - update Enigmail to 1.6 - The passphrase timeout configuration in Enigmail is now read and written from/to gpg-agent. - New dialog to change the expiry date of keys - New function to search for the OpenPGP keys of all Address Book entries on a keyserver - removed obsolete enigmail-build.patch Changes in xulrunner : - update to 17.0.10esr (bnc#847708) - require NSS 3.14.4 or above - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers - update to 17.0.9esr (bnc#840485) - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests - MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety hazards - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong 'this' object Changes in mozilla-nspr : - update to version 4.10.1 - bmo#888273: RWIN Scaling (RFC1323) limited to 2 on Windows 7 and 8 (Windows only) - bmo#907512: Unix platforms shouldn't mask errors specific to Unix domain sockets
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75186
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75186
    title openSUSE Security Update : Mozilla Suite (openSUSE-SU-2013:1633-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-1268.NASL
    description From Red Hat Security Advisory 2013:1268 : Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Firefox handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 17.0.9 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 17.0.9 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 69940
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69940
    title Oracle Linux 5 / 6 : firefox (ELSA-2013-1268)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-717.NASL
    description This xulrunner17 version update to 17.0.9esr fixes the following security issues (bnc#840485) : - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests - MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety hazards - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong 'this' object
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75148
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75148
    title openSUSE Security Update : xulrunner17 (openSUSE-SU-2013:1496-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-17047.NASL
    description Upstream security update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 70205
    published 2013-09-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70205
    title Fedora 18 : firefox-24.0-1.fc18 / xulrunner-24.0-2.fc18 (2013-17047)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-719.NASL
    description This MozillaThunderbird update to version 24.0 fixes several security and non-security issues : - update to Thunderbird 24.0 (bnc#840485) - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong 'this' object - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC hazard with default compartments and frame chain restoration - moved greek to common translation package - require NSPR 4.10 and NSS 3.15.1 - add GStreamer build requirements for Gecko - added enigmail-build.patch to fix TB packaging (bmo#886095) - removed obsolete patches : - enigmail-old-gcc.patch - mozilla-gcc43-enums.patch - mozilla-gcc43-template_hacks.patch - mozilla-gcc43-templates_instantiation.patch - ppc-xpcshell.patch
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75150
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75150
    title openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2013:1495-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-17074.NASL
    description Upstream update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 70062
    published 2013-09-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70062
    title Fedora 20 : firefox-24.0-1.fc20 / xulrunner-24.0-2.fc20 (2013-17074)
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_24.NASL
    description The installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist that could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch can result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 69993
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69993
    title Firefox < 24.0 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2762.NASL
    description Multiple security issues have been found in Icedove, Debian's version of the Mozilla Thunderbird mail and news client. Multiple memory safety errors and buffer overflows may lead to the execution of arbitrary code. The Icedove version in the oldstable distribution (squeeze) is no longer supported with full security updates. However, it should be noted that almost all security issues in Icedove stem from the included browser engine. These security problems only affect Icedove if scripting and HTML mails are enabled. If there are security issues specific to Icedove (e.g. a hypothetical buffer overflow in the IMAP implementation) we'll make an effort to backport such fixes to oldstable.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 70080
    published 2013-09-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70080
    title Debian DSA-2762-1 : icedove - several vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_24.NASL
    description The installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by multiple vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments can result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker can exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch can result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This can result in access restrictions being bypassed. (CVE-2013-1737) - An issue in the NVIDIA OS X graphic drivers allows the user's desktop to be viewed by web content, potentially exposing sensitive information. (CVE-2013-1729)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 69989
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69989
    title Firefox < 24.0 Multiple Vulnerabilities (Mac OS X)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1269.NASL
    description An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Thunderbird handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 17.0.9 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 69944
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69944
    title RHEL 5 / 6 : thunderbird (RHSA-2013:1269)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FIREFOX_17_0_9_ESR.NASL
    description The installed version of Firefox ESR 17.x is earlier than 17.0.9 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - Multiple use-after-free problems exist that can result in denial of service attacks or arbitrary code execution. (CVE-2013-1735, CVE-2013-1736) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - A JavaScript compartment mismatch can result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - Incorrect scope handling for JavaScript objects with compartments can result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This can result in access restrictions being bypassed. (CVE-2013-1737)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 69988
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69988
    title Firefox ESR 17.x < 17.0.9 Multiple Vulnerabilities (Mac OS X)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_THUNDERBIRD_24_0.NASL
    description The installed version of Thunderbird is a version prior to 24.0. It is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737) - An input validation error exists related to email messages containing HTML and iframes and the action of replying to or forwarding such messages that could allow cross-site scripting attacks. (CVE-2013-6674) - An input validation error exists related to email messages containing HTML and object or embed elements that could allow cross-site scripting attacks. (CVE-2014-2018)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 69991
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69991
    title Thunderbird 17.x through 23.x Multiple Vulnerabilities (Mac OS X)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-16992.NASL
    description Upstream security update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 70036
    published 2013-09-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70036
    title Fedora 19 : firefox-24.0-1.fc19 / xulrunner-24.0-2.fc19 (2013-16992)
  • NASL family Windows
    NASL id MOZILLA_THUNDERBIRD_24.NASL
    description The installed version of Thunderbird is 17.x or later but prior to 24. It is, therefore, potentially affected the following vulnerabilities: - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737) - An input validation error exists related to email messages containing HTML and iframes and the action of replying to or forwarding such messages that could allow cross-site scripting attacks. (CVE-2013-6674) - An input validation error exists related to email messages containing HTML and object or embed elements that could allow cross-site scripting attacks. (CVE-2014-2018)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 69995
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69995
    title Mozilla Thunderbird 17.x through 23.x Multiple Vulnerabilities
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-1269.NASL
    description From Red Hat Security Advisory 2013:1269 : An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Thunderbird handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 17.0.9 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 69941
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69941
    title Oracle Linux 6 : thunderbird (ELSA-2013-1269)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_7DFED67B20AA11E3B8D80025905A4771.NASL
    description The Mozilla Project reports : MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9) MFSA 2013-77 Improper state in HTML5 Tree Builder with templates MFSA 2013-78 Integer overflow in ANGLE library MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed MFSA 2013-81 Use-after-free with select element MFSA 2013-82 Calling scope for new JavaScript objects can lead to memory corruption MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification MFSA 2013-84 Same-origin bypass through symbolic links MFSA 2013-85 Uninitialized data in IonMonkey MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers MFSA 2013-87 Shared object library loading from writable location MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes MFSA 2013-89 Buffer overflow with multi-column, lists, and floats MFSA 2013-90 Memory corruption involving scrolling MFSA 2013-91 User-defined properties on DOM proxies get the wrong 'this' object MFSA 2013-92 GC hazard with default compartments and frame chain restoration
    last seen 2019-02-21
    modified 2018-11-21
    plugin id 70262
    published 2013-10-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70262
    title FreeBSD : mozilla -- multiple vulnerabilities (7dfed67b-20aa-11e3-b8d8-0025905a4771)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2759.NASL
    description Multiple security issues have been found in Iceweasel, Debian's version of the Mozilla Firefox web browser: Multiple memory safety errors, buffer overflows may lead to the execution of arbitrary code. The Iceweasel version in the oldstable distribution (squeeze) is no longer supported with security updates.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 69959
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69959
    title Debian DSA-2759-1 : iceweasel - several vulnerabilities
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-718.NASL
    description This MozillaFirefox update to version 24.0 fixes several security and non-security issues : - move greek to the translations-common package (bnc#840551) - update to Firefox 24.0 (bnc#840485) - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow in ANGLE library - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong 'this' object - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC hazard with default compartments and frame chain restoration - enable gstreamer explicitely via pref (gecko.js) - require NSS 3.15.1
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75149
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75149
    title openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1493-1)
  • NASL family Windows
    NASL id SEAMONKEY_221.NASL
    description The installed version of SeaMonkey is earlier than 2.21 and thus, is potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737)
    last seen 2019-02-21
    modified 2018-07-27
    plugin id 69996
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69996
    title SeaMonkey < 2.21 Multiple Vulnerabilities
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_THUNDERBIRD_17_0_9_ESR.NASL
    description The installed version of Thunderbird ESR 17.x is prior to 17.0.9 and is, therefore, potentially affected the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - Multiple use-after-free problems exist that could result in denial of service attacks or arbitrary code execution. (CVE-2013-1735, CVE-2013-1736) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737)
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 69990
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69990
    title Thunderbird ESR 17.x < 17.0.9 Multiple Vulnerabilities (Mac OS X)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2013-720.NASL
    description This seamonkey update to version 2.21 fixes several security and non-security issues : - update to SeaMonkey 2.21 (bnc#840485) - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow in ANGLE library - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong 'this' object - MFSA 2013-92/CVE-2013-1738 (bmo#887334, bmo#882897) GC hazard with default compartments and frame chain restoration - requires NSS 3.15.1
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75151
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75151
    title openSUSE Security Update : seamonkey (openSUSE-SU-2013:1491-1)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20130917_FIREFOX_ON_SL5_X.NASL
    description Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Firefox handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add- on code make incorrect, security sensitive decisions. (CVE-2013-1737) After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 69945
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69945
    title Scientific Linux Security Update : firefox on SL5.x, SL6.x i386/srpm/x86_64
  • NASL family Windows
    NASL id MOZILLA_THUNDERBIRD_1709_ESR.NASL
    description The installed version of Thunderbird ESR 17.x is earlier than 17.0.9 and is, therefore, potentially affected the following vulnerabilities: - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - Multiple use-after-free problems exist that could result in denial of service attacks or arbitrary code execution. (CVE-2013-1735, CVE-2013-1736) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This can result in access restrictions being bypassed. (CVE-2013-1737)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 69994
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69994
    title Mozilla Thunderbird ESR 17.x < 17.0.9 Multiple Vulnerabilities
  • NASL family Windows
    NASL id MOZILLA_FIREFOX_1709_ESR.NASL
    description The installed version of Firefox ESR 17.x is earlier than 17.0.9, and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - Multiple use-after-free problems exist that could result in denial of service attacks or arbitrary code execution. (CVE-2013-1735, CVE-2013-1736) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737)
    last seen 2019-02-21
    modified 2018-07-16
    plugin id 69992
    published 2013-09-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69992
    title Firefox ESR 17.x < 17.0.9 Multiple Vulnerabilities
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20130917_THUNDERBIRD_ON_SL5_X.NASL
    description Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Thunderbird handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add- on code make incorrect, security sensitive decisions. (CVE-2013-1737) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 69946
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69946
    title Scientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/srpm/x86_64
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1951-1.NASL
    description Multiple memory safety issues were discovered in Firefox. If a user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1718, CVE-2013-1719) Atte Kettunen discovered a flaw in the HTML5 Tree Builder when interacting with template elements. In some circumstances, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1720) Alex Chapman discovered an integer overflow vulnerability in the ANGLE library. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1721) Abhishek Arya discovered a use-after-free in the Animation Manager. An attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1722) Scott Bell discovered a use-after-free when using a select element. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1724) It was discovered that the scope of new JavaScript objects could be accessed before their compartment is initialized. An attacker could potentially exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2013-1725) Dan Gohman discovered that some variables and data were used in IonMonkey, without being initialized, which could lead to information leakage. (CVE-2013-1728) Sachin Shinde discovered a crash when moving some XBL-backed nodes in to a document created by document.open(). An attacker could potentially exploit this to cause a denial of service. (CVE-2013-1730) Aki Helin discovered a buffer overflow when combining lists, floats and multiple columns. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1732) Two memory corruption bugs when scrolling were discovered. An attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1735, CVE-2013-1736) Boris Zbarsky discovered that user-defined getters on DOM proxies would use the expando object as 'this'. An attacker could potentially exploit this by tricking add-on code in to making incorrect security sensitive decisions based on malicious values. (CVE-2013-1737) A use-after-free bug was discovered in Firefox. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1738). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 69947
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69947
    title Ubuntu 12.04 LTS / 12.10 / 13.04 : firefox vulnerabilities (USN-1951-1)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-1268.NASL
    description Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Firefox handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 17.0.9 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 17.0.9 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 69936
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69936
    title CentOS 5 / 6 : firefox (CESA-2013:1268)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1268.NASL
    description Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Firefox handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 17.0.9 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 17.0.9 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 69943
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69943
    title RHEL 5 / 6 : firefox (RHSA-2013:1268)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-1269.NASL
    description An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Thunderbird handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 17.0.9 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 69937
    published 2013-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=69937
    title CentOS 5 / 6 : thunderbird (CESA-2013:1269)
oval via4
accepted 2014-10-06T04:02:42.378-04:00
class vulnerability
contributors
  • name Shane Shaffer
    organization G2, Inc.
  • name Shane Shaffer
    organization G2, Inc.
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
  • name Richard Helbing
    organization baramundi software
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
  • name Evgeniy Pavlov
    organization ALTX-SOFT
definition_extensions
  • comment Mozilla Firefox Mainline release is installed
    oval oval:org.mitre.oval:def:22259
  • comment Mozilla Thunderbird Mainline release is installed
    oval oval:org.mitre.oval:def:22093
  • comment Mozilla Seamonkey is installed
    oval oval:org.mitre.oval:def:6372
  • comment Mozilla Firefox ESR is installed
    oval oval:org.mitre.oval:def:22414
  • comment Mozilla Thunderbird ESR is installed
    oval oval:org.mitre.oval:def:22216
description Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object.
family windows
id oval:org.mitre.oval:def:18789
status accepted
submitted 2013-09-18T21:23:33.068-04:00
title Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the thisobject during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object.
version 36
redhat via4
advisories
  • bugzilla
    id 1009041
    title object (MFSA 2013-91)
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhsa:tst:20070055001
      • OR
        • AND
          • comment xulrunner is earlier than 0:17.0.9-1.el5_9
            oval oval:com.redhat.rhsa:tst:20131268002
          • comment xulrunner is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20080569003
        • AND
          • comment xulrunner-devel is earlier than 0:17.0.9-1.el5_9
            oval oval:com.redhat.rhsa:tst:20131268004
          • comment xulrunner-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20080569005
        • AND
          • comment firefox is earlier than 0:17.0.9-1.el5_9
            oval oval:com.redhat.rhsa:tst:20131268006
          • comment firefox is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070097009
    • AND
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhsa:tst:20100842001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhsa:tst:20100842002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhsa:tst:20100842003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhsa:tst:20100842004
      • OR
        • AND
          • comment xulrunner is earlier than 0:17.0.9-1.el6_4
            oval oval:com.redhat.rhsa:tst:20131268012
          • comment xulrunner is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100861006
        • AND
          • comment xulrunner-devel is earlier than 0:17.0.9-1.el6_4
            oval oval:com.redhat.rhsa:tst:20131268014
          • comment xulrunner-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100861008
        • AND
          • comment firefox is earlier than 0:17.0.9-1.el6_4
            oval oval:com.redhat.rhsa:tst:20131268016
          • comment firefox is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20100861010
    rhsa
    id RHSA-2013:1268
    released 2013-09-17
    severity Critical
    title RHSA-2013:1268: firefox security update (Critical)
  • bugzilla
    id 1009041
    title object (MFSA 2013-91)
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhsa:tst:20070055001
      • comment thunderbird is earlier than 0:17.0.9-1.el5_9
        oval oval:com.redhat.rhsa:tst:20131269002
      • comment thunderbird is signed with Red Hat redhatrelease key
        oval oval:com.redhat.rhsa:tst:20070108003
    • AND
      • comment thunderbird is earlier than 0:17.0.9-1.el6_4
        oval oval:com.redhat.rhsa:tst:20131269008
      • comment thunderbird is signed with Red Hat redhatrelease2 key
        oval oval:com.redhat.rhsa:tst:20100896006
      • OR
        • comment Red Hat Enterprise Linux 6 Client is installed
          oval oval:com.redhat.rhsa:tst:20100842001
        • comment Red Hat Enterprise Linux 6 Server is installed
          oval oval:com.redhat.rhsa:tst:20100842002
        • comment Red Hat Enterprise Linux 6 Workstation is installed
          oval oval:com.redhat.rhsa:tst:20100842003
        • comment Red Hat Enterprise Linux 6 ComputeNode is installed
          oval oval:com.redhat.rhsa:tst:20100842004
    rhsa
    id RHSA-2013:1269
    released 2013-09-17
    severity Important
    title RHSA-2013:1269: thunderbird security update (Important)
rpms
  • xulrunner-0:17.0.9-1.el5_9
  • xulrunner-devel-0:17.0.9-1.el5_9
  • firefox-0:17.0.9-1.el5_9
  • xulrunner-0:17.0.9-1.el6_4
  • xulrunner-devel-0:17.0.9-1.el6_4
  • firefox-0:17.0.9-1.el6_4
  • thunderbird-0:17.0.9-1.el5_9
  • thunderbird-0:17.0.9-1.el6_4
refmap via4
bid 62475
confirm
debian DSA-2762
fedora
  • FEDORA-2013-16992
  • FEDORA-2013-17047
  • FEDORA-2013-17074
suse
  • openSUSE-SU-2013:1491
  • openSUSE-SU-2013:1493
  • openSUSE-SU-2013:1495
  • openSUSE-SU-2013:1496
  • openSUSE-SU-2013:1499
  • openSUSE-SU-2013:1633
ubuntu
  • USN-1951-1
  • USN-1952-1
Last major update 06-01-2017 - 21:59
Published 18-09-2013 - 06:08
Last modified 18-09-2017 - 21:36
Back to Top