CVE-2013-5615
published 2013-12-11CVE-2013-5615: The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not…
PriorityP337critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.22%
89.9th percentile
The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain typeset restrictions on the generation of GetElementIC typed array stubs, which has unspecified impact and remote attack vectors.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mozilla | firefox | < 26.0 | 26.0 |
| mozilla | firefox | >= 24.0 < 24.2 | 24.2 |
| mozilla | seamonkey | < 2.23 | 2.23 |
| mozilla | thunderbird | < 24.2 | 24.2 |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| suse | suse_linux_enterprise_desktop | — | — |
| suse | suse_linux_enterprise_server | — | — |
| suse | suse_linux_enterprise_software_development_kit | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2013-12-11·CVSS 9.8
CVE-2013-5609 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Ben Turner, Bobby Holley, Jesse Ruderman and Christian Holler discovered
multiple memory safety issues in Thunderbird. If a user were tricked in to
opening a specially crafted message with scripting enabled, an attacker
could potentially exploit these to cause a denial of service via
application crash, or execute arbitrary code with the privileges of the
user invoking Thunderbird. (CVE-2013-5609)
Tyson Smith and Jesse Schwartzentruber discovered a use-after-free in
event listeners. If a user had enabled scripting, an attacker could
potentially exploit this to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Thunderbird. (CVE-20
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2013-12-11·CVSS 9.8
CVE-2013-5609 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Ben Turner, Bobby Holley, Jesse Ruderman, Christian Holler and Christoph
Diehl discovered multiple memory safety issues in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user invoking
Firefox. (CVE-2013-5609, CVE-2013-5610)
Myk Melez discovered that the doorhanger notification for web app
installation could persist between page navigations. An attacker could
potentially exploit this to conduct clickjacking attacks. (CVE-2013-5611)
Masato Kinugawa discovered that pages with missin
Red Hat
Mozilla: GetElementIC typed array stubs can be generated outside observed typesets (MFSA 2013-115)
vendor_redhat·2013-12-10·CVSS 9.8
CVE-2013-5615 [CRITICAL] Mozilla: GetElementIC typed array stubs can be generated outside observed typesets (MFSA 2013-115)
Mozilla: GetElementIC typed array stubs can be generated outside observed typesets (MFSA 2013-115)
The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain typeset restrictions on the generation of GetElementIC typed array stubs, which has unspecified impact and remote attack vectors.
Statement: Not Vulnerable. This issue does not affect the version of firefox and thunderbrid shipped with Red Hat Enterprise Linux 5 and 6.
Package: firefox (Red Hat Enterprise Linux 5) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 5) - Not affected
Package: firefox (Red Hat Enterprise Linux 6) - Not affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Not affec
GHSA
GHSA-7qw2-p67q-h5xq: The JavaScript implementation in Mozilla Firefox before 26
ghsa_unreviewed·2022-05-13
CVE-2013-5615 [CRITICAL] GHSA-7qw2-p67q-h5xq: The JavaScript implementation in Mozilla Firefox before 26
The JavaScript implementation in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 does not properly enforce certain typeset restrictions on the generation of GetElementIC typed array stubs, which has unspecified impact and remote attack vectors.
No detection rules found.
No public exploits indexed.
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-12/msg00010.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00085.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00086.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00087.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00119.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00120.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00121.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00002.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-115.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securitytracker.com/id/1029470http://www.securitytracker.com/id/1029476http://www.ubuntu.com/usn/USN-2052-1http://www.ubuntu.com/usn/USN-2053-1https://bugzilla.mozilla.org/show_bug.cgi?id=929261https://security.gentoo.org/glsa/201504-01http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-12/msg00010.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00085.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00086.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00087.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00119.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00120.htmlhttp://lists.opensuse.org/opensuse-updates/2013-12/msg00121.htmlhttp://lists.opensuse.org/opensuse-updates/2014-01/msg00002.htmlhttp://www.mozilla.org/security/announce/2013/mfsa2013-115.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://www.securitytracker.com/id/1029470http://www.securitytracker.com/id/1029476http://www.ubuntu.com/usn/USN-2052-1http://www.ubuntu.com/usn/USN-2053-1https://bugzilla.mozilla.org/show_bug.cgi?id=929261https://security.gentoo.org/glsa/201504-01
2013-12-11
Published