⚠ Actively exploited
Added to CISA KEV on 2022-03-03. Federal agencies required to patch by 2022-03-24. Required action: Apply updates per vendor instructions..
CVE-2013-1675
Severity
6.5MEDIUM
EPSS
4.7%
top 10.59%
CISA KEV
KEV
Added 2022-03-03
Due 2022-03-24
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedMay 16
KEV addedMar 3
KEV dueMar 24
Latest updateMay 17
CISA Required Action: Apply updates per vendor instructions.
Description
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages8 packages
Also affects: Debian Linux 7.0, Ubuntu Linux 12.04, 12.10, 13.04, Enterprise Linux 5.9, 6.4, 5.0, 6.0, 5.0_ppc, 6.0_ppc64, 5.9_ppc, 6.4_ppc64