CVE-2013-0763
published 2013-01-13CVE-2013-0763: Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and…
PriorityP335critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
4.40%
90.2th percentile
Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to Mesa drivers and a resized WebGL canvas.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| mozilla | firefox | < 18.0 | 18.0 |
| mozilla | firefox | >= 10.0 < 10.0.12 | 10.0.12 |
| mozilla | firefox | >= 17.0 < 17.0.2 | 17.0.2 |
| mozilla | seamonkey | < 2.15 | 2.15 |
| mozilla | thunderbird | < 17.0.2 | 17.0.2 |
| mozilla | thunderbird_esr | >= 10.0 < 10.0.12 | 10.0.12 |
| mozilla | thunderbird_esr | >= 17.0 < 17.0.2 | 17.0.2 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox regression
vendor_ubuntu·2013-02-05·CVSS 9.3
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1681-1 introduced a regression in Firefox.
USN-1681-1 fixed vulnerabilities in Firefox. Due to an upstream regression,
Firefox suffered from instabilities when accessing some websites. This
update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CV
Ubuntu
Firefox regression
vendor_ubuntu·2013-01-22·CVSS 9.3
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1681-1 introduced a regression in Firefox.
USN-1681-1 fixed vulnerabilities in Firefox. Due to an upstream regression,
some translations became unusable after upgrading. This update fixes the
problem.
We apologize for the inconvenience.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CV
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2013-01-09·CVSS 9.3
CVE-2013-0769 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Several security issues were fixed in Firefox.
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CVE-2013-0770)
Abhishek Arya discovered several user-after-free and buffer overflows in
Firefox. An attacker could exploit these to cause a denial of service via
application crash, or potentially execute code with the pr
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2013-01-09·CVSS 9.3
CVE-2013-0769 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
USN-1681-1 fixed vulnerabilities in Firefox. This update provides the
corresponding updates for Thunderbird.
Original advisory details:
Christoph Diehl, Christian Holler, Mats Palmgren, Chiaki Ishikawa, Bill
Gianopoulos, Benoit Jacob, Gary Kwong, Robert O'Callahan, Jesse Ruderman,
and Julian Seward discovered multiple memory safety issues affecting
Firefox. If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0769, CVE-2013-0749, CVE-2013-0770)
Abhishek Arya discovered several user-after-free and buffer
Red Hat
Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)
vendor_redhat·2013-01-08·CVSS 9.3
CVE-2013-0763 [CRITICAL] CWE-416 Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)
Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)
Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to Mesa drivers and a resized WebGL canvas.
Statement: Not Vulnerable. This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbir
Red Hat
glibc: stack overflow in getaddrinfo()'s use of alloca()
vendor_redhat·2011-04-13·CVSS 7.5
CVE-2013-4357 [HIGH] CWE-121 glibc: stack overflow in getaddrinfo()'s use of alloca()
glibc: stack overflow in getaddrinfo()'s use of alloca()
The eglibc package before 2.14 incorrectly handled the getaddrinfo() function. An attacker could use this issue to cause a denial of service.
Statement: This issue has already been addressed in Red Hat Enterprise Linux 5 via http://rhn.redhat.com/errata/RHBA-2013-0022.html and in Red Hat Enterprise Linux 6 via http://rhn.redhat.com/errata/RHBA-2012-0763.html
Package: glibc (Red Hat Enterprise Linux 5) - Not affected
Package: glibc (Red Hat Enterprise Linux 6) - Not affected
Package: glibc (Red Hat Enterprise Linux 7) - Not affected
Red Hat
glibc: stack overflow in getaddrinfo()'s use of alloca()
vendor_redhat·2011-04-13·CVSS 7.5
CVE-2012-6686 [HIGH] CWE-121 glibc: stack overflow in getaddrinfo()'s use of alloca()
glibc: stack overflow in getaddrinfo()'s use of alloca()
[REJECTED CVE] This CVE has been rejected. This candidate is a duplicate of CVE-2013-4357. Note: All CVE users should reference CVE-2013-4357 instead of this candidate.
Statement: This issue has already been addressed in Red Hat Enterprise Linux 5 via http://rhn.redhat.com/errata/RHBA-2013-0022.html and in Red Hat Enterprise Linux 6 via http://rhn.redhat.com/errata/RHBA-2012-0763.html
Package: glibc (Red Hat Enterprise Linux 7) - Not affected
GHSA
GHSA-9j2f-w8x5-5qfx: Use-after-free vulnerability in Mozilla Firefox before 18
ghsa_unreviewed·2022-05-13
CVE-2013-0763 [HIGH] CWE-416 GHSA-9j2f-w8x5-5qfx: Use-after-free vulnerability in Mozilla Firefox before 18
Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to Mesa drivers and a resized WebGL canvas.
No detection rules found.
No public exploits indexed.
arXiv
Browser Feature Usage on the Modern Web
arxiv_fulltext·2016-05-20
Browser Feature Usage on the Modern Web
Browser Feature Usage on the Modern Web
4
Peter Snyder
[email protected]
Lara Ansari
[email protected]
Cynthia Taylor
[email protected]
Chris Kanich
[email protected]
Department of Computer Science
University of Illinois at Chicago
Chicago, IL 60607
Draft:
CDF
HTML and JavaScript
HTML
commodity web browsers
JavaScript
cross-site scripting
[1]
#1.
1,392
74
186
470
111
Firefox
46.0.1
[1]red#1
## Abstract
Modern web browsers are incredibly complex, with millions of lines of code and
over one thousand functions and properties available to website authors.
This work investigates how these browser features are used on the modern, open
web. We find that features differ wildly in popularity, with over 50% of
provided features never used in the Alexa 10k.
We also look at how popular ad an
Bugzilla
CVE-2013-0760 CVE-2013-0761 CVE-2013-0763 CVE-2013-0771 Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)
bugzilla·2013-01-04·CVSS 9.3
CVE-2013-0760 [CRITICAL] CVE-2013-0760 CVE-2013-0761 CVE-2013-0763 CVE-2013-0771 Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)
CVE-2013-0760 CVE-2013-0761 CVE-2013-0763 CVE-2013-0771 Mozilla: Use-after-free and buffer overflow issues found using Address Sanitizer (MFSA 2013-02)
Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team discovered a series critically rated of use-after-free, out of bounds read, and buffer overflow issues using the Address Sanitizer tool in shipped software. These issues are potentially exploitable, allowing for remote code execution. We would also like to thank Abhishek for reporting three additional user-after-free and out of bounds read flaws introduced during Firefox development that were fixed before general release.
In general these flaws cannot be exploited through email in the Thunderbird and SeaMonkey products because scripting is disabled, but are pot
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-02.htmlhttp://www.ubuntu.com/usn/USN-1681-1http://www.ubuntu.com/usn/USN-1681-2http://www.ubuntu.com/usn/USN-1681-4https://bugzilla.mozilla.org/show_bug.cgi?id=791905https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17107http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-02.htmlhttp://www.ubuntu.com/usn/USN-1681-1http://www.ubuntu.com/usn/USN-1681-2http://www.ubuntu.com/usn/USN-1681-4https://bugzilla.mozilla.org/show_bug.cgi?id=791905https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17107
2013-01-13
Published