CVE-2013-1696
published 2013-06-26CVE-2013-1696: Mozilla Firefox before 22.0 does not properly enforce the X-Frame-Options protection mechanism, which allows remote attackers to conduct clickjacking attacks…
PriorityP416medium4CVSS 2.0
AVNACHAuNCPIPAN
EPSS
1.66%
74.4th percentile
Mozilla Firefox before 22.0 does not properly enforce the X-Frame-Options protection mechanism, which allows remote attackers to conduct clickjacking attacks via a crafted web site that uses the HTTP server push feature with multipart responses.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | firefox | <= 21.0 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:N
vendor_ubuntu10.0CRITICAL
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-p8m8-g4qv-wxqh: Mozilla Firefox before 22
ghsa_unreviewed·2022-05-17
CVE-2013-1696 [MEDIUM] GHSA-p8m8-g4qv-wxqh: Mozilla Firefox before 22
Mozilla Firefox before 22.0 does not properly enforce the X-Frame-Options protection mechanism, which allows remote attackers to conduct clickjacking attacks via a crafted web site that uses the HTTP server push feature with multipart responses.
Ubuntu
Firefox regression
vendor_ubuntu·2013-07-03·CVSS 10.0
[CRITICAL] Firefox regression
Title: Firefox regression
Summary: USN-1890-1 introduced a regression in Firefox.
USN-1890-1 fixed vulnerabilities in Firefox. This update introduced a
regression which sometimes resulted in Firefox using the wrong network
proxy settings. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Multiple memory safety issues were discovered in Firefox. If the user were
tricked into opening a specially crafted page, an attacker could possibly
exploit these to cause a denial of service via application crash, or
potentially execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2013-1682, CVE-2013-1683)
Abhishek Arya discovered multiple use-after-free bugs. If the user were
tricked into opening a specially crafted page, an attac
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2013-06-26·CVSS 10.0
CVE-2013-1682 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Multiple memory safety issues were discovered in Firefox. If the user were
tricked into opening a specially crafted page, an attacker could possibly
exploit these to cause a denial of service via application crash, or
potentially execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2013-1682, CVE-2013-1683)
Abhishek Arya discovered multiple use-after-free bugs. If the user were
tricked into opening a specially crafted page, an attacker could possibly
exploit these to execute arbitrary code with the privileges of the user
invoking Firefox. (CVE-2013-1684, CVE-2013-1685, CVE-2013-1686)
Mariusz Mlynski discovered that user defined
Red Hat
Mozilla: X-Frame-Options ignored when using server push with multi-part responses (MFSA 2013-58)
vendor_redhat·2013-06-25·CVSS 4.0
CVE-2013-1696 [MEDIUM] Mozilla: X-Frame-Options ignored when using server push with multi-part responses (MFSA 2013-58)
Mozilla: X-Frame-Options ignored when using server push with multi-part responses (MFSA 2013-58)
Mozilla Firefox before 22.0 does not properly enforce the X-Frame-Options protection mechanism, which allows remote attackers to conduct clickjacking attacks via a crafted web site that uses the HTTP server push feature with multipart responses.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affected
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-58.htmlhttp://www.ubuntu.com/usn/USN-1890-1https://bugzilla.mozilla.org/show_bug.cgi?id=761667https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16992http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-58.htmlhttp://www.ubuntu.com/usn/USN-1890-1https://bugzilla.mozilla.org/show_bug.cgi?id=761667https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16992
2013-06-26
Published