CVE-2013-0752
published 2013-01-13CVE-2013-0752: Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allow…
PriorityP340critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
6.62%
93.1th percentile
Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XBL file with multiple bindings that have SVG content.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| mozilla | firefox | < 17.0.2 | 17.0.2 |
| mozilla | firefox | < 18.0 | 18.0 |
| mozilla | seamonkey | < 2.15 | 2.15 |
| mozilla | thunderbird | < 17.0.2 | 17.0.2 |
| mozilla | thunderbird_esr | < 17.0.2 | 17.0.2 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox regression
vendor_ubuntu·2013-02-05·CVSS 9.3
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1681-1 introduced a regression in Firefox.
USN-1681-1 fixed vulnerabilities in Firefox. Due to an upstream regression,
Firefox suffered from instabilities when accessing some websites. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CV
Ubuntu
Firefox regression
vendor_ubuntu·2013-01-22·CVSS 9.3
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1681-1 introduced a regression in Firefox.
USN-1681-1 fixed vulnerabilities in Firefox. Due to an upstream regression,
some translations became unusable after upgrading. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CV
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2013-01-09·CVSS 9.3
CVE-2013-0769 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CVE-2013-0770)
Abhishek Arya discovered several user-after-free and buffer overflows in
Firefox. An attacker could exploit these to cause a denial of service via
application crash, or potentially execute code with the pr
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2013-01-09·CVSS 9.3
CVE-2013-0769 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
USN-1681-1 fixed vulnerabilities in Firefox. This update provides the
corresponding updates for Thunderbird.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CVE-2013-0770)
Abhishek Arya discovered several user-after-free and buffer
Red Hat
Mozilla: Memory corruption in XBL with XML bindings containing SVG (MFSA 2013-13)
vendor_redhat·2013-01-08·CVSS 9.3
CVE-2013-0752 [CRITICAL] Mozilla: Memory corruption in XBL with XML bindings containing SVG (MFSA 2013-13)
Mozilla: Memory corruption in XBL with XML bindings containing SVG (MFSA 2013-13)
Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XBL file with multiple bindings that have SVG content.
Statement: Not Vulnerable. This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affected
GHSA
GHSA-c9v9-mwfc-95f2: Mozilla Firefox before 18
ghsa_unreviewed·2022-05-13
CVE-2013-0752 [HIGH] CWE-119 GHSA-c9v9-mwfc-95f2: Mozilla Firefox before 18
Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XBL file with multiple bindings that have SVG content.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-1557 OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329)
bugzilla·2013-04-16·CVSS 10.0
CVE-2013-1557 [CRITICAL] CVE-2013-1557 OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329)
CVE-2013-1557 OpenJDK: LogStream.setDefaultStream() missing security restrictions (RMI, 8001329)
It was discovered that LogStream.setDefaultStream() is missing security restrictions. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in Oracle Java SE 7u21 and 6u45.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-0751.html
---
OpenJDK7 up
Bugzilla
CVE-2013-2436 OpenJDK: Wrapper.convert insufficient type checks (Libraries, 8009049)
bugzilla·2013-04-16·CVSS 9.3
CVE-2013-2436 [CRITICAL] CVE-2013-2436 OpenJDK: Wrapper.convert insufficient type checks (Libraries, 8009049)
CVE-2013-2436 OpenJDK: Wrapper.convert insufficient type checks (Libraries, 8009049)
It was discovered that the sun.util.invoke.Wrapper did not perform type checks correctly when converting wrapped values. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in 7u21.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-0751.html
---
OpenJDK7 ups
Bugzilla
CVE-2013-1558 OpenJDK: java.beans.ThreadGroupContext missing restrictions (Beans, 7200507)
bugzilla·2013-04-16·CVSS 10.0
CVE-2013-1558 [CRITICAL] CVE-2013-1558 OpenJDK: java.beans.ThreadGroupContext missing restrictions (Beans, 7200507)
CVE-2013-1558 OpenJDK: java.beans.ThreadGroupContext missing restrictions (Beans, 7200507)
It was discovered that the java.beans.ThreadGroupContext did not properly restrict access to the contexts field. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in 7u21 and 6u45.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-0751.html
---
OpenJ
Bugzilla
CVE-2013-2429 OpenJDK: JPEGImageWriter state corruption (ImageIO, 8007918)
bugzilla·2013-04-16·CVSS 7.6
CVE-2013-2429 [HIGH] CVE-2013-2429 OpenJDK: JPEGImageWriter state corruption (ImageIO, 8007918)
CVE-2013-2429 OpenJDK: JPEGImageWriter state corruption (ImageIO, 8007918)
It was discovered that JPEGImageWriter did not protect against modification of its state while performing certain native code operations. An untrusted Java application or applet could possibly use this flaw to trigger JVM memory corruption.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in Oracle Java SE 7u21 and 6u45.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-
Bugzilla
CVE-2013-2420 OpenJDK: image processing vulnerability (2D, 8007617)
bugzilla·2013-04-16·CVSS 10.0
CVE-2013-2420 [CRITICAL] CVE-2013-2420 OpenJDK: image processing vulnerability (2D, 8007617)
CVE-2013-2420 OpenJDK: image processing vulnerability (2D, 8007617)
It was discovered that the 2D component did not properly process certain images. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in 7u21 and 6u45.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-0751.html
---
OpenJDK7 upstream repositories commit:
http://hg.openjdk.ja
Bugzilla
CVE-2013-2431 OpenJDK: Hotspot intrinsic frames vulnerability (Hotspot, 8004336)
bugzilla·2013-04-16·CVSS 10.0
CVE-2013-2431 [CRITICAL] CVE-2013-2431 OpenJDK: Hotspot intrinsic frames vulnerability (Hotspot, 8004336)
CVE-2013-2431 OpenJDK: Hotspot intrinsic frames vulnerability (Hotspot, 8004336)
It was discovered that the Hotspot component did not properly handle certain intrinsic frames. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in Oracle Java SE 7u21.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-0751.html
---
OpenJDK7 upstream repositor
Bugzilla
CVE-2013-2426 OpenJDK: ConcurrentHashMap incorrectly calls defaultReadObject() method (Libraries, 8009063)
bugzilla·2013-04-16·CVSS 9.3
CVE-2013-2426 [CRITICAL] CVE-2013-2426 OpenJDK: ConcurrentHashMap incorrectly calls defaultReadObject() method (Libraries, 8009063)
CVE-2013-2426 OpenJDK: ConcurrentHashMap incorrectly calls defaultReadObject() method (Libraries, 8009063)
It was discovered that the ConcurrentHashMap class incorrectly calls the defaultReadObject() method. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in Oracle Java SE 7u21.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-0751.html
Bugzilla
CVE-2013-2421 OpenJDK: Hotspot MethodHandle lookup error (Hotspot, 8009699)
bugzilla·2013-04-16·CVSS 9.3
CVE-2013-2421 [CRITICAL] CVE-2013-2421 OpenJDK: Hotspot MethodHandle lookup error (Hotspot, 8009699)
CVE-2013-2421 OpenJDK: Hotspot MethodHandle lookup error (Hotspot, 8009699)
It was discovered that the Hotspot component did not properly perform certain MethodHandle lookups. An untrusted Java application or applet could possibly use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in Oracle Java SE 7u21.
---
OpenJDK7 upstream repositories commit:
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/hotspot/rev/663b5c744e82
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterpri
Bugzilla
CVE-2013-2415 OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542)
bugzilla·2013-04-15·CVSS 2.1
CVE-2013-2415 [LOW] CVE-2013-2415 OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542)
CVE-2013-2415 OpenJDK: temporary files created with insecure permissions (JAX-WS, 8003542)
It was discovered that JAX-WS could possibly create temporary files with insecure permissions. A local attacker could use this flaw to access temporary files created by an application using JAX-WS.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in Oracle Java SE 7u21.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https://rhn.redhat.com/errata/RHSA-2013-0751.html
---
OpenJDK7 upstream re
Bugzilla
CVE-2013-2423 OpenJDK: incorrect setter access checks in MethodHandles (Hostspot, 8009677)
bugzilla·2013-04-15·CVSS 3.7
CVE-2013-2423 [LOW] CVE-2013-2423 OpenJDK: incorrect setter access checks in MethodHandles (Hostspot, 8009677)
CVE-2013-2423 OpenJDK: incorrect setter access checks in MethodHandles (Hostspot, 8009677)
java.lang.invoke.MethodHandles did not perform access checks correctly. An untrusted Java application or applet could use this to set value of a final field.
Discussion:
Public now via Oracle Java SE CPU April 2014:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Fixed in Oracle Java SE 7u21.
---
OpenJDK7 upstream repositories commit:
http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/b453d9be6b3f
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 5
Via RHSA-2013:0752 https://rhn.redhat.com/errata/RHSA-2013-0752.html
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:0751 https:
Bugzilla
CVE-2013-0752 Mozilla: Memory corruption in XBL with XML bindings containing SVG (MFSA 2013-13)
bugzilla·2013-01-05·CVSS 9.3
CVE-2013-0752 [CRITICAL] CVE-2013-0752 Mozilla: Memory corruption in XBL with XML bindings containing SVG (MFSA 2013-13)
CVE-2013-0752 Mozilla: Memory corruption in XBL with XML bindings containing SVG (MFSA 2013-13)
Security researcher Sviatoslav Chagaev reported that when using an XBL file containing multiple XML bindings with SVG content, a memory corruption can occur. In concern with remote XUL, this can lead to an exploitable crash.
In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products.
External Reference:
http://www.mozilla.org/security/announce/2013/mfsa2013-13.html
Acknowledgements:
Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Sviatoslav Chagaev as the original reporter.
Statement:
Not
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-13.htmlhttp://www.ubuntu.com/usn/USN-1681-1http://www.ubuntu.com/usn/USN-1681-2http://www.ubuntu.com/usn/USN-1681-4https://bugzilla.mozilla.org/show_bug.cgi?id=805024https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16694http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-13.htmlhttp://www.ubuntu.com/usn/USN-1681-1http://www.ubuntu.com/usn/USN-1681-2http://www.ubuntu.com/usn/USN-1681-4https://bugzilla.mozilla.org/show_bug.cgi?id=805024https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16694
2013-01-13
Published