CVE-2013-0758
published 2013-01-13CVE-2013-0758: Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x…
PriorityP271critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
73.36%
99.4th percentile
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| mozilla | firefox | < 18.0 | 18.0 |
| mozilla | firefox | >= 10.0 < 10.0.12 | 10.0.12 |
| mozilla | firefox | >= 17.0 < 17.0.2 | 17.0.2 |
| mozilla | seamonkey | < 2.15 | 2.15 |
| mozilla | thunderbird | < 17.0.2 | 17.0.2 |
| mozilla | thunderbird_esr | >= 10.0 < 10.0.12 | 10.0.12 |
| mozilla | thunderbird_esr | >= 17.0 < 17.0.2 | 17.0.2 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for requests matching /*.swf$ from a Firefox 17.x User-Agent, which may indicate delivery of the exploit's Flash trigger payload. ↗
- →Detect SVG 'use' element href being set to the current page location with a fragment (e.g., location.href + '#a'), which is the mechanism used to clone the plugin object into anonymous SVG content. ↗
- →Detect attempts to overwrite __proto__ on a frame's prototype to an object exposing 'setTimeout' and 'call', which is the CVE-2013-0757 wrapper bypass step chained with this CVE. ↗
- →The exploit navigates a child frame to a chrome:// URL via a cloned Flash plugin object inside an SVG 'use' element; monitor for child frame navigations to chrome:// scheme from web content. ↗
- →The exploit delivers an HTML page with an embedded object, a base tag, and an SVG use element; look for responses containing all three together targeting Firefox 17.x clients. ↗
- ·The exploit targets only Firefox 17.0 and 17.0.1 with Flash installed; it does not use memory corruption and requires JavaScript to be enabled. ↗
- ·In Thunderbird and SeaMonkey, the flaw cannot be exploited via email because scripting is disabled, but may be exploitable in browser-like contexts. ↗
- ·Any Firefox plugin with script access (not just Flash) can be used to trigger the SVG plugin cloning vulnerability. ↗
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox regression
vendor_ubuntu·2013-02-05·CVSS 9.3
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1681-1 introduced a regression in Firefox.
USN-1681-1 fixed vulnerabilities in Firefox. Due to an upstream regression,
Firefox suffered from instabilities when accessing some websites. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CV
Ubuntu
Firefox regression
vendor_ubuntu·2013-01-22·CVSS 9.3
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1681-1 introduced a regression in Firefox.
USN-1681-1 fixed vulnerabilities in Firefox. Due to an upstream regression,
some translations became unusable after upgrading. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CV
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2013-01-09·CVSS 9.3
CVE-2013-0769 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CVE-2013-0770)
Abhishek Arya discovered several user-after-free and buffer overflows in
Firefox. An attacker could exploit these to cause a denial of service via
application crash, or potentially execute code with the pr
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2013-01-09·CVSS 9.3
CVE-2013-0769 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
USN-1681-1 fixed vulnerabilities in Firefox. This update provides the
corresponding updates for Thunderbird.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CVE-2013-0770)
Abhishek Arya discovered several user-after-free and buffer
Red Hat
Mozilla: Chrome Object Wrapper (COW) bypass through plugin objects (MFSA 2013-15)
vendor_redhat·2013-01-08·CVSS 9.3
CVE-2013-0758 [CRITICAL] Mozilla: Chrome Object Wrapper (COW) bypass through plugin objects (MFSA 2013-15)
Mozilla: Chrome Object Wrapper (COW) bypass through plugin objects (MFSA 2013-15)
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.
Package: thunderbird (Red Hat Enterprise Linux 5) - Affected
GHSA
GHSA-7p7h-fc6x-mhrh: Mozilla Firefox before 18
ghsa_unreviewed·2022-05-13
CVE-2013-0758 [HIGH] CWE-94 GHSA-7p7h-fc6x-mhrh: Mozilla Firefox before 18
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.
No detection rules found.
Exploit-DB
GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)
exploitdb·2014-12-18·CVSS 9.8
CVE-2013-0758 [CRITICAL] GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)
GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial 'Malicious Git and Mercurial HTTP Server For CVE-2014-9390',
'Description' => %q(
This module exploits CVE-2014-9390, which affects Git (versions less
than 1.8.5.6, 1.9.5, 2.0.5, 2.1.4 and 2.2.1) and Mercurial (versions
less than 3.2.3) and describes three vulnerabilities.
On operating systems which have case-insensitive file systems, like
Windows and OS X, Git clients can be convinced to retrieve and
overwrite sensitive configuration files in the .git
directory which can allow arbitrary code execution if a vulnerable
client can be convinced to perform certain actions (for example,
a checkout) against a malicious Git repository.
A second vulnerability with similar characteristics also exists in both
Git and Mercurial clients, on HFS+ file sys
Exploit-DB
Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)
exploitdb·2013-01-08·CVSS 9.3
CVE-2013-0758 [CRITICAL] Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)
Mozilla Firefox HttpClients::FF,
# :ua_minver => "17.0",
# :ua_maxver => "17.0.1",
# :javascript => true,
# :rank => NormalRanking
# })
def initialize(info = {})
super(update_info(info,
'Name' => 'Firefox 17.0.1 Flash Privileged Code Injection',
'Description' => %q{
This exploit gains remote code execution on Firefox 17 and 17.0.1, provided
the user has installed Flash. No memory corruption is used.
First, a Flash object is cloned into the anonymous content of the SVG
"use" element in the (CVE-2013-0758). From there, the Flash object
can navigate a child frame to a URL in the chrome:// scheme.
Then a separate exploit (CVE-2013-0757) is used to bypass the security wrapper
around the child frame's window reference and inject code into the chrome://
context. Once we have injection into the c
Metasploit
Firefox 17.0.1 Flash Privileged Code Injection
metasploit·CVSS 9.3
CVE-2013-0758 [CRITICAL] Firefox 17.0.1 Flash Privileged Code Injection
Firefox 17.0.1 Flash Privileged Code Injection
This exploit gains remote code execution on Firefox 17 and 17.0.1, provided the user has installed Flash. No memory corruption is used. First, a Flash object is cloned into the anonymous content of the SVG "use" element in the (CVE-2013-0758). From there, the Flash object can navigate a child frame to a URL in the chrome:// scheme. Then a separate exploit (CVE-2013-0757) is used to bypass the security wrapper around the child frame's window reference and inject code into the chrome:// context. Once we have injection into the chrome execution context, we can write the payload to disk, chmod it (if posix), and then execute. Note: Flash is used here to trigger the exploit but any Firefox plugin with script access should be able to trigger it.
Bugzilla
CVE-2013-2394 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (2D)
bugzilla·2013-04-17·CVSS 7.6
CVE-2013-2394 [HIGH] CVE-2013-2394 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (2D)
CVE-2013-2394 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (2D)
Oracle Java SE 7 Update 21 and 6 Update 45 fixes an unspecified vulnerability in the 2D component (CVE-2013-2394). Upstream has CVSSv2 scored this issue as: 7.6/AV:N/AC:H/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Discussion:
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 6
Supplementary for Red Hat Enterprise Linux 5
Via RHSA-2013:0758 https://rhn.redhat.com/errata/RHSA-2013-0758.html
---
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 5
Supplementary for Red Hat Enterprise Linux 6
Via RHSA-2013:0757 https://rhn.redhat.com/errata/RHS
Bugzilla
CVE-2013-2435 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
bugzilla·2013-04-17·CVSS 10.0
CVE-2013-2435 [CRITICAL] CVE-2013-2435 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
CVE-2013-2435 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
Oracle Java SE 7 Update 21 and 6 Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2435). Upstream has CVSSv2 scored this issue as: 10.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Discussion:
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 6
Supplementary for Red Hat Enterprise Linux 5
Via RHSA-2013:0758 https://rhn.redhat.com/errata/RHSA-2013-0758.html
---
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 5
Supplementary for Red Hat Enterprise Linux 6
Via RHSA-2013:0757 https://rhn.redh
Bugzilla
CVE-2013-1540 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
bugzilla·2013-04-17·CVSS 4.3
CVE-2013-1540 [MEDIUM] CVE-2013-1540 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
CVE-2013-1540 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
Oracle Java SE 7 Update 21 and 6 Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-1540). Upstream has CVSSv2 scored this issue as: 4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Discussion:
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 6
Supplementary for Red Hat Enterprise Linux 5
Via RHSA-2013:0758 https://rhn.redhat.com/errata/RHSA-2013-0758.html
---
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 5
Supplementary for Red Hat Enterprise Linux 6
Via RHSA-2013:0757 https://rhn.redha
Bugzilla
CVE-2013-2433 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
bugzilla·2013-04-17·CVSS 4.3
CVE-2013-2433 [MEDIUM] CVE-2013-2433 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
CVE-2013-2433 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Deployment)
Oracle Java SE 7 Update 21 and 6 Update 45 fixes an unspecified vulnerability in the Deployment component (CVE-2013-2433). Upstream has CVSSv2 scored this issue as: 4.3/AV:N/AC:M/Au:N/C:N/I:P/A:N
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Discussion:
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 6
Supplementary for Red Hat Enterprise Linux 5
Via RHSA-2013:0758 https://rhn.redhat.com/errata/RHSA-2013-0758.html
---
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 5
Supplementary for Red Hat Enterprise Linux 6
Via RHSA-2013:0757 https://rhn.redha
Bugzilla
CVE-2013-2439 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Install)
bugzilla·2013-04-17·CVSS 6.9
CVE-2013-2439 [MEDIUM] CVE-2013-2439 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Install)
CVE-2013-2439 Oracle JDK: unspecified vulnerability fixed in 7u21 and 6u45 (Install)
Oracle Java SE 7 Update 21 and 6 Update 45 fixes an unspecified vulnerability in the Install component (CVE-2013-2439). Upstream has CVSSv2 scored this issue as: 6.9/AV:L/AC:M/Au:N/C:C/I:C/A:C
External Reference:
http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html
Discussion:
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 6
Supplementary for Red Hat Enterprise Linux 5
Via RHSA-2013:0758 https://rhn.redhat.com/errata/RHSA-2013-0758.html
---
This issue has been addressed in following products:
Supplementary for Red Hat Enterprise Linux 5
Supplementary for Red Hat Enterprise Linux 6
Via RHSA-2013:0757 https://rhn.redhat.com/
Bugzilla
CVE-2013-0758 Mozilla: Chrome Object Wrapper (COW) bypass through plugin objects (MFSA 2013-15)
bugzilla·2013-01-05·CVSS 9.3
CVE-2013-0758 [CRITICAL] CVE-2013-0758 Mozilla: Chrome Object Wrapper (COW) bypass through plugin objects (MFSA 2013-15)
CVE-2013-0758 Mozilla: Chrome Object Wrapper (COW) bypass through plugin objects (MFSA 2013-15)
Security researcher Mariusz Mlynski reported that it is possible to bypass Chrome Object Wrappers (COW) and open a chrome privileged web page through plugin objects. This could allow for arbitrary code execution.
In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are potentially a risk in browser or browser-like contexts in those products.
External Reference:
http://www.mozilla.org/security/announce/2013/mfsa2013-15.html
Acknowledgements:
Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Mariusz Mlynski as the original reporter.
Discussion:
This issue has bee
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0144.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0145.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-15.htmlhttp://www.ubuntu.com/usn/USN-1681-1http://www.ubuntu.com/usn/USN-1681-2http://www.ubuntu.com/usn/USN-1681-4https://bugzilla.mozilla.org/show_bug.cgi?id=813906https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17087http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0144.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0145.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-15.htmlhttp://www.ubuntu.com/usn/USN-1681-1http://www.ubuntu.com/usn/USN-1681-2http://www.ubuntu.com/usn/USN-1681-4https://bugzilla.mozilla.org/show_bug.cgi?id=813906https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17087
2013-01-13
Published