CVE-2013-0757

published 2013-01-13

CVE-2013-0757: The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x…

critical 9.3 CVSS 3.1

AV N AC M Au N C C I C A C

EXPLOIT

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.

Affected

18 ranges

Vendor	Product	Version range	Fixed in
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
mozilla	firefox	< 17.0.2	17.0.2
mozilla	firefox	< 18.0	18.0
mozilla	seamonkey	< 2.15	2.15
mozilla	thunderbird	< 17.0.2	17.0.2
mozilla	thunderbird_esr	< 17.0.2	17.0.2
opensuse	opensuse	—	—
opensuse	opensuse	—	—
opensuse	opensuse	—	—
suse	linux_enterprise_desktop	—	—
suse	linux_enterprise_desktop	—	—
suse	linux_enterprise_server	—	—
suse	linux_enterprise_server	—	—
suse	linux_enterprise_software_development_kit	—	—
suse	linux_enterprise_software_development_kit	—	—

CWE-20