CVE-2013-5611
published 2013-12-11CVE-2013-5611: Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App…
PriorityP423medium5.8CVSS 2.0
AVNACMAuNCNIPAP
EPSS
2.14%
80.0th percentile
Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App installation site by controlling the timing of page navigation.
Affected
210 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mozilla | firefox | <= 25.0.1 | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
| mozilla | firefox | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
vendor_ubuntu9.8CRITICAL
vendor_redhat5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3v2g-q648-8v38: Mozilla Firefox before 26
ghsa_unreviewed·2022-05-14
CVE-2013-5611 [MEDIUM] GHSA-3v2g-q648-8v38: Mozilla Firefox before 26
Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App installation site by controlling the timing of page navigation.
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2013-12-11·CVSS 9.8
CVE-2013-5609 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler and Christoph
Diehl discovered multiple memory safety issues in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2013-5609, CVE-2013-5610)
Myk Melez discovered that the doorhanger notification for web app
installation could persist between page navigations. An attacker could
potentially exploit this to conduct clickjacking attacks. (CVE-2013-5611)
Masato Kinugawa discovered that pages with missin
Red Hat
Mozilla: Application Installation doorhanger persists on navigation (MFSA 2013-105)
vendor_redhat·2013-12-10·CVSS 5.8
CVE-2013-5611 [MEDIUM] Mozilla: Application Installation doorhanger persists on navigation (MFSA 2013-105)
Mozilla: Application Installation doorhanger persists on navigation (MFSA 2013-105)
Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App installation site by controlling the timing of page navigation.
Statement: This issue does not affect the version of firefox and thunderbird as shipped with Red Hat Enterprise Linux 5 and 6
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-5611 Mozilla: Application Installation doorhanger persists on navigation (MFSA 2013-105)
bugzilla·2013-12-09·CVSS 5.8
CVE-2013-5611 [MEDIUM] CVE-2013-5611 Mozilla: Application Installation doorhanger persists on navigation (MFSA 2013-105)
CVE-2013-5611 Mozilla: Application Installation doorhanger persists on navigation (MFSA 2013-105)
Mozilla developer Myk Melez reported that with specifically timed page navigation, the doorhanger notification for Web App installation could persist from one site to another without being dismissed by the navigation. This could be used by a malicious site to trick a user into installing an application from one site while making it appear to come from another.
External Reference:
http://www.mozilla.org/security/announce/2013/mfsa2013-105.html
Acknowledgements:
Red Hat would like to thank the Mozilla project for reporting this issue. Upstream acknowledges Myk Melez as the original reporter.
Statement:
This issue does not affect the version of firefox and thunderbird as shipped with Red
Bugzilla
mysql: Oracle CPU January 2013
bugzilla·2013-01-15·CVSS 6.5
CVE-2012-5611 [MEDIUM] mysql: Oracle CPU January 2013
mysql: Oracle CPU January 2013
This bug is for Oracle Critical Patch Update Advisory - January 2013:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
Pre-release of the advisory indicates that it will include 18 CVEs for MySQL, 2 of them remotely exploitable without authentication.
This update is likely to mention previously published issues as CVE-2012-5611 (bug 881064, comment 21) and CVE-2012-5612 (bug 882600).
Discussion:
MySQL risk matrix:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html#AppendixMSQL
Fixes are included in version 5.1.67 and 5.5.29.
Previous CPU for MySQL was released in October 2012 (bug 870399) and covered issues up to versions 5.1.66 and 5.5.28. Hence these are releases since the last CPU:
http://dev.mysql.c
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-12/msg00010.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00085.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00086.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00087.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00002.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-105.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securitytracker.com/id/1029470http://www.ubuntu.com/usn/USN-2052-1https://bugzilla.mozilla.org/show_bug.cgi?id=771294http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-12/msg00010.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00085.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00086.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00087.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00002.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-105.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securitytracker.com/id/1029470http://www.ubuntu.com/usn/USN-2052-1https://bugzilla.mozilla.org/show_bug.cgi?id=771294
2013-12-11
Published