CVE-2013-1688
published 2013-06-26CVE-2013-1688: The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute…
PriorityP345critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
2.56%
83.3th percentile
The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 21.0 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_ubuntu10.0CRITICAL
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Firefox regression
vendor_ubuntu·2013-07-03·CVSS 10.0
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1890-1 introduced a regression in Firefox.
USN-1890-1 fixed vulnerabilities in Firefox. This update introduced a
regression which sometimes resulted in Firefox using the wrong network
proxy settings. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple memory safety issues were discovered in Firefox. If the user were
tricked into opening a specially crafted page, an attacker could possibly
exploit these to cause a denial of service via application crash, or
potentially execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2013-1682, CVE-2013-1683)
Abhishek Arya discovered multiple use-after-free bugs. If the user were
tricked into opening a specially crafted page, an attac
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2013-06-26·CVSS 10.0
CVE-2013-1682 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Multiple memory safety issues were discovered in Firefox. If the user were
tricked into opening a specially crafted page, an attacker could possibly
exploit these to cause a denial of service via application crash, or
potentially execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2013-1682, CVE-2013-1683)
Abhishek Arya discovered multiple use-after-free bugs. If the user were
tricked into opening a specially crafted page, an attacker could possibly
exploit these to execute arbitrary code with the privileges of the user
invoking Firefox. (CVE-2013-1684, CVE-2013-1685, CVE-2013-1686)
Mariusz Mlynski discovered that user defined
Red Hat
Mozilla: Arbitrary code execution within Profiler (MFSA 2013-52)
vendor_redhat·2013-06-25·CVSS 9.3
CVE-2013-1688 [CRITICAL] Mozilla: Arbitrary code execution within Profiler (MFSA 2013-52)
Mozilla: Arbitrary code execution within Profiler (MFSA 2013-52)
The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affected
GHSA
GHSA-frv7-g69x-8pp3: The Profiler implementation in Mozilla Firefox before 22
ghsa_unreviewed·2022-05-17
CVE-2013-1688 [HIGH] CWE-94 GHSA-frv7-g69x-8pp3: The Profiler implementation in Mozilla Firefox before 22
The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-52.htmlhttp://www.ubuntu.com/usn/USN-1890-1https://bugzilla.mozilla.org/show_bug.cgi?id=873966https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16427http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-52.htmlhttp://www.ubuntu.com/usn/USN-1890-1https://bugzilla.mozilla.org/show_bug.cgi?id=873966https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16427
2013-06-26
Published