FKIE_CVE-2013-1687
Vulnerability from fkie_nvd - Published: 2013-06-26 03:19 - Updated: 2025-04-11 00:51
Severity ?
Summary
The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mozilla | firefox | * | |
| mozilla | firefox | 19.0 | |
| mozilla | firefox | 19.0.1 | |
| mozilla | firefox | 19.0.2 | |
| mozilla | firefox | 20.0 | |
| mozilla | firefox | 20.0.1 | |
| mozilla | firefox | 17.0 | |
| mozilla | firefox | 17.0.1 | |
| mozilla | firefox | 17.0.2 | |
| mozilla | firefox | 17.0.3 | |
| mozilla | firefox | 17.0.4 | |
| mozilla | firefox | 17.0.5 | |
| mozilla | firefox | 17.0.6 | |
| mozilla | thunderbird | * | |
| mozilla | thunderbird | 17.0 | |
| mozilla | thunderbird | 17.0.1 | |
| mozilla | thunderbird | 17.0.2 | |
| mozilla | thunderbird | 17.0.3 | |
| mozilla | thunderbird | 17.0.4 | |
| mozilla | thunderbird | 17.0.5 | |
| mozilla | thunderbird_esr | 17.0 | |
| mozilla | thunderbird_esr | 17.0.1 | |
| mozilla | thunderbird_esr | 17.0.2 | |
| mozilla | thunderbird_esr | 17.0.3 | |
| mozilla | thunderbird_esr | 17.0.4 | |
| mozilla | thunderbird_esr | 17.0.5 | |
| mozilla | thunderbird_esr | 17.0.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"matchCriteriaId": "29071754-CC8F-42D9-82D4-140236802506",
"versionEndIncluding": "21.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*",
"matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "DE09D089-7F48-466B-B03A-C64152A12615",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "653D73DA-21C0-4C3F-9269-5A6D5C5B1E34",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*",
"matchCriteriaId": "804A0ACE-EB28-413D-93F4-E849FEA01390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3BA49C6F-9115-41A5-BBDE-743CB9DEDDA8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3283FBAC-B77A-4C62-9D51-70BB35FA3D13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "886D8A1F-ECDD-4FE9-A4E5-2322EEC0B880",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E10B8803-C319-4AAA-81CF-FA206A33BA55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "E2B5567C-8969-456D-B6DF-3562B99C41FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:17.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5657779C-19F9-42B8-BBBD-292B898E8FD2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:17.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "EEA3B9F4-BD8E-488B-A362-0B86BC6DA275",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:firefox:17.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6A91BD4A-76BD-40B9-9E12-22CACAAE42BF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C8122DC-6877-4EC8-8041-B579FC5AC6CA",
"versionEndIncluding": "17.0.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C2FD78A8-0D3A-412C-8776-20C598697564",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "777D8DC5-8D43-4842-B0A7-3C933F41F6E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "808C66D2-4C53-4544-AD21-443D9A400B84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "6FB95E8B-CF01-471F-8306-BB9FB0896904",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AF7E092E-BCBE-48B4-8F6A-D3E4A0369AE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "BB1D90B0-9E81-4828-8122-A66FB0953863",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*",
"matchCriteriaId": "341D94CE-C0EB-47FA-A043-E7B0F4344BBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "84C3EE07-F201-451A-89A1-A41B8B2165E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "45837B42-7D29-4475-94F1-E29CD5831C7F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7028A433-7D1B-4C6F-A0F6-1B69682F7853",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "86C07513-8F98-4FA6-837D-7D735AE5EA91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "E1D87C70-0EC2-49DE-A59D-CAF22760BC9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "61AE2EAA-55A4-4FC9-BC3F-0FEE5BB2DE99",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site."
},
{
"lang": "es",
"value": "Las implementaciones System Only Wrapper (SOW) y Chrome Object Wrapper (COW) en Mozilla Firefox anterior a v22.0, Firefox ESR v17.x anterior a v17.0.7, Thunderbird anterior a v17.0.7, y Thunderbird ESR v17.x anterior a v17.0.7 no restringen adecuadamente las funciones XBL definidas por el usuario lo que permite a atacantes remotos ejecutar c\u00f3digo JavaScript con privilegios de chrome, o llevar a cabo ataques de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) a trav\u00e9s de un sitios web manipulado."
}
],
"id": "CVE-2013-1687",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-06-26T03:19:10.757",
"references": [
{
"source": "security@mozilla.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"
},
{
"source": "security@mozilla.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"
},
{
"source": "security@mozilla.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"
},
{
"source": "security@mozilla.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"
},
{
"source": "security@mozilla.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"
},
{
"source": "security@mozilla.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"
},
{
"source": "security@mozilla.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"
},
{
"source": "security@mozilla.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"
},
{
"source": "security@mozilla.org",
"url": "http://www.debian.org/security/2013/dsa-2716"
},
{
"source": "security@mozilla.org",
"url": "http://www.debian.org/security/2013/dsa-2720"
},
{
"source": "security@mozilla.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.mozilla.org/security/announce/2013/mfsa2013-51.html"
},
{
"source": "security@mozilla.org",
"url": "http://www.securityfocus.com/bid/60777"
},
{
"source": "security@mozilla.org",
"url": "http://www.ubuntu.com/usn/USN-1890-1"
},
{
"source": "security@mozilla.org",
"url": "http://www.ubuntu.com/usn/USN-1891-1"
},
{
"source": "security@mozilla.org",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=863933"
},
{
"source": "security@mozilla.org",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=866823"
},
{
"source": "security@mozilla.org",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17117"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2716"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2720"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.mozilla.org/security/announce/2013/mfsa2013-51.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/60777"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1890-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1891-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=863933"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=866823"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17117"
}
],
"sourceIdentifier": "security@mozilla.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…