CVE-2013-0795
published 2013-04-03CVE-2013-0795: The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x…
PriorityP339critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
3.43%
87.6th percentile
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which allows remote attackers to bypass the Same Origin Policy or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.
Affected
67 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 19.0.2 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | seamonkey | <= 2.17 | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
| mozilla | seamonkey | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
vendor_ubuntu10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2013-04-08·CVSS 10.0
CVE-2013-0788 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Olli Pettay, Jesse Ruderman, Boris Zbarsky, Christian Holler, Milan
Sreckovic and Joe Drew discovered multiple memory safety issues affecting
Thunderbird. If the user were tricked into opening a specially crafted
message with scripting enabled, an attacker could possibly exploit these
to cause a denial of service via application crash, or potentially
execute code with the privileges of the user invoking Thunderbird.
(CVE-2013-0788)
Ambroz Bizjak discovered an out-of-bounds array read in the
CERT_DecodeCertPackage function of the Network Security Services (NSS)
libary when decoding certain certificates. An attacker could potentially
exploit this to cause a denial of service via application cras
Ubuntu
Unity Firefox Extension update
vendor_ubuntu·2013-04-04·CVSS 10.0
[CRITICAL] Unity Firefox Extension update
Title: Unity Firefox Extension update
Summary: This update provides a compatible version of Unity Firefox Extension for
Firefox 20.
USN-1786-1 fixed vulnerabilities in Firefox. This update provides the
corresponding update for Unity Firefox Extension.
Original advisory details:
Olli Pettay, Jesse Ruderman, Boris Zbarsky, Christian Holler, Milan
Sreckovic, Joe Drew, Andrew McCreight, Randell Jesup, Gary Kwong and
Mats Palmgren discovered multiple memory safety issues affecting Firefox.
If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0788, CVE-2013-0789)
Ambroz Bizjak discovered an out-of-boun
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2013-04-04·CVSS 10.0
CVE-2013-0788 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Olli Pettay, Jesse Ruderman, Boris Zbarsky, Christian Holler, Milan
Sreckovic, Joe Drew, Andrew McCreight, Randell Jesup, Gary Kwong and
Mats Palmgren discovered multiple memory safety issues affecting Firefox.
If the user were tricked into opening a specially crafted page, an
attacker could possibly exploit these to cause a denial of service via
application crash, or potentially execute code with the privileges of the
user invoking Firefox. (CVE-2013-0788, CVE-2013-0789)
Ambroz Bizjak discovered an out-of-bounds array read in the
CERT_DecodeCertPackage function of the Network Security Services (NSS)
libary when decoding certain certificates. An attacker
Red Hat
Mozilla: Bypass of SOW protections allows cloning of protected nodes (MFSA 2013-36)
vendor_redhat·2013-04-02·CVSS 10.0
CVE-2013-0795 [CRITICAL] Mozilla: Bypass of SOW protections allows cloning of protected nodes (MFSA 2013-36)
Mozilla: Bypass of SOW protections allows cloning of protected nodes (MFSA 2013-36)
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which allows remote attackers to bypass the Same Origin Policy or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.
Package: thunderbird (Red Hat Enterprise Linux 5) - Affected
GHSA
GHSA-7phr-5276-4mqw: The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20
ghsa_unreviewed·2022-05-17
CVE-2013-0795 [HIGH] GHSA-7phr-5276-4mqw: The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which allows remote attackers to bypass the Same Origin Policy or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.htmlhttp://lists.opensuse.org/opensuse-updates/2013-06/msg00012.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0696.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0697.htmlhttp://www.debian.org/security/2013/dsa-2699http://www.mozilla.org/security/announce/2013/mfsa2013-36.htmlhttp://www.ubuntu.com/usn/USN-1791-1https://bugzilla.mozilla.org/show_bug.cgi?id=825697https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16842http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.htmlhttp://lists.opensuse.org/opensuse-updates/2013-06/msg00012.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0696.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0697.htmlhttp://www.debian.org/security/2013/dsa-2699http://www.mozilla.org/security/announce/2013/mfsa2013-36.htmlhttp://www.ubuntu.com/usn/USN-1791-1https://bugzilla.mozilla.org/show_bug.cgi?id=825697https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16842
2013-04-03
Published