CVE-2013-0753
published 2013-01-13CVE-2013-0753: Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before…
PriorityP267critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
51.32%
98.9th percentile
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| mozilla | firefox | < 18.0 | 18.0 |
| mozilla | firefox | >= 10.0 < 10.0.12 | 10.0.12 |
| mozilla | firefox | >= 17.0 < 17.0.2 | 17.0.2 |
| mozilla | seamonkey | < 2.15 | 2.15 |
| mozilla | thunderbird | < 17.0.2 | 17.0.2 |
| mozilla | thunderbird_esr | >= 10.0 < 10.0.12 | 10.0.12 |
| mozilla | thunderbird_esr | >= 17.0 < 17.0.2 | 17.0.2 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x64\xa1\x18\x00\x00\x00
- →The exploit targets Firefox 17.0 / Windows XP SP3 via a browser-delivered HTML page using heap spray with chunk size 0x40000 and a fake vftable pointer at 0x0c10100c in sprayed memory. ↗
- →The exploit uses serializeToStream with a specially crafted OutputStream defining its own write function to trigger the use-after-free of an Element object. ↗
- →The exploit module sets EXITFUNC to 'process' and uses PrependMigrate, with payload BadChars of \x00 and DisableNops true — useful for payload-level detection. ↗
- →The stack pivot gadget used is 'xchg eax,esp # ret' from msvcrt.dll at 0x77c15ed5 on Windows XP SP3 — monitor for ROP chains pivoting via msvcrt in Firefox process context. ↗
- →Heap spray uses 0x40000-byte chunks with a 0x10-byte header; detect large repeated heap allocations of this size in browser processes. ↗
- ·The module was tested successfully only on Firefox 17.0.1 ESR, 17.0.1 and 17.0 on Windows XP SP3; exploitation on other targets is not confirmed. ↗
- ·Payload space is set to 30000 bytes as a sprayed chunk value; this is a module-specific configuration and not a hard constraint of the vulnerability. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox regression
vendor_ubuntu·2013-02-05·CVSS 9.3
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1681-1 introduced a regression in Firefox.
USN-1681-1 fixed vulnerabilities in Firefox. Due to an upstream regression,
Firefox suffered from instabilities when accessing some websites. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CV
Ubuntu
Firefox regression
vendor_ubuntu·2013-01-22·CVSS 9.3
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1681-1 introduced a regression in Firefox.
USN-1681-1 fixed vulnerabilities in Firefox. Due to an upstream regression,
some translations became unusable after upgrading. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CV
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2013-01-09·CVSS 9.3
CVE-2013-0769 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CVE-2013-0770)
Abhishek Arya discovered several user-after-free and buffer overflows in
Firefox. An attacker could exploit these to cause a denial of service via
application crash, or potentially execute code with the pr
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2013-01-09·CVSS 9.3
CVE-2013-0769 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
USN-1681-1 fixed vulnerabilities in Firefox. This update provides the
corresponding updates for Thunderbird.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CVE-2013-0770)
Abhishek Arya discovered several user-after-free and buffer
Red Hat
Mozilla: Use-after-free in serializeToStream (MFSA 2013-16)
vendor_redhat·2013-01-08·CVSS 9.3
CVE-2013-0753 [CRITICAL] CWE-416 Mozilla: Use-after-free in serializeToStream (MFSA 2013-16)
Mozilla: Use-after-free in serializeToStream (MFSA 2013-16)
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.
Package: thunderbird (Red Hat Enterprise Linux 5) - Affected
GHSA
GHSA-6x74-c24h-qxmw: Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18
ghsa_unreviewed·2022-05-13
CVE-2013-0753 [HIGH] CWE-416 GHSA-6x74-c24h-qxmw: Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.
No detection rules found.
Exploit-DB
Mozilla Firefox - XMLSerializer Use-After-Free (Metasploit)
exploitdb·2013-08-29
CVE-2013-0753 Mozilla Firefox - XMLSerializer Use-After-Free (Metasploit)
Mozilla Firefox - XMLSerializer Use-After-Free (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Firefox XMLSerializer Use After Free',
'Description' => %q{
This module exploits a vulnerability found on Firefox 17.0 ( MSF_LICENSE,
'Author' =>
[
'regenrecht', # Vulnerability Discovery, Analysis and PoC
'juan vazquez' # Metasploit module
],
'References' =>
[
[ 'CVE', '2013-0753' ],
[ 'OSVDB', '89021'],
[ 'BID', '57209'],
[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-13-006/' ],
[ 'URL', 'http://www.mozilla.org/security
Metasploit
Firefox XMLSerializer Use After Free
metasploit
Firefox XMLSerializer Use After Free
Firefox XMLSerializer Use After Free
This module exploits a vulnerability found on Firefox 17.0 (< 17.0.2), specifically a use-after-free of an Element object, when using the serializeToStream method with a specially crafted OutputStream defining its own write function. This module has been tested successfully with Firefox 17.0.1 ESR, 17.0.1 and 17.0 on Windows XP SP3.
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0144.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0145.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-16.htmlhttp://www.ubuntu.com/usn/USN-1681-1http://www.ubuntu.com/usn/USN-1681-2http://www.ubuntu.com/usn/USN-1681-4https://bugzilla.mozilla.org/show_bug.cgi?id=814001https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17053http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0144.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0145.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-16.htmlhttp://www.ubuntu.com/usn/USN-1681-1http://www.ubuntu.com/usn/USN-1681-2http://www.ubuntu.com/usn/USN-1681-4https://bugzilla.mozilla.org/show_bug.cgi?id=814001https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17053
2013-01-13
Published