CVE-2013-0795 — Mozilla Firefox vulnerability

CWE-2647 documents6 sources
Severity
10.0CRITICALNVD
EPSS
1.5%
top 18.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla SeamonkeyMozilla Thunderbird+1 more
Timeline
PublishedApr 3
Latest updateMay 17

Description

The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which allows remote attackers to bypass the Same Origin Policy or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages4 packages

▶NVDmozilla/firefox19.0.2+7
▶NVDmozilla/thunderbird5 versions+4
▶NVDmozilla/thunderbird_esr5 versions+4
▶NVDmozilla/seamonkey2.17+48

🔴Vulnerability Details

2
GHSA
GHSA-7phr-5276-4mqw: The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20↗2022-05-17
▶
CVEList
CVE-2013-0795: The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20↗2013-04-03
▶

📋Vendor Advisories

3
Ubuntu
Thunderbird vulnerabilities↗2013-04-08
▶
Ubuntu
Firefox vulnerabilities↗2013-04-04
▶
Red Hat
Mozilla: Bypass of SOW protections allows cloning of protected nodes (MFSA 2013-36)↗2013-04-02
▶

💬Community

1
Bugzilla
CVE-2013-0795 Mozilla: Bypass of SOW protections allows cloning of protected nodes (MFSA 2013-36)↗2013-04-01
▶
CVE-2013-0795 — Mozilla Firefox vulnerability | cvebase