CVE-2013-0773

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

The Chrome Object Wrapper (COW) and System Only Wrapper (SOW) implementations in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 do not prevent modifications to a prototype, which allows remote attackers to obtain sensitive information from chrome objects or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.htmlMailing List, Third Party Advisory
http://www.debian.org/security/2013/dsa-2699Third Party Advisory
http://www.mozilla.org/security/announce/2013/mfsa2013-24.htmlVendor Advisory
http://www.ubuntu.com/usn/USN-1729-1Third Party Advisory
http://www.ubuntu.com/usn/USN-1729-2Third Party Advisory
http://www.ubuntu.com/usn/USN-1748-1Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=809652Issue Tracking, Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16861Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.htmlMailing List, Third Party Advisory
http://www.debian.org/security/2013/dsa-2699Third Party Advisory
http://www.mozilla.org/security/announce/2013/mfsa2013-24.htmlVendor Advisory
http://www.ubuntu.com/usn/USN-1729-1Third Party Advisory
http://www.ubuntu.com/usn/USN-1729-2Third Party Advisory
http://www.ubuntu.com/usn/USN-1748-1Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=809652Issue Tracking, Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16861Third Party Advisory

Timeline

Published: Feb 19, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-07744.3Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey be CVE-2013-07759.3Use-after-free vulnerability in the nsImageLoadingContent::OnStopContainer function in Mozilla Firefox before 19.0, Firefox ESR 17.x before CVE-2013-07764.0Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey be CVE-2013-07779.3Use-after-free vulnerability in the nsDisplayBoxShadowOuter::Paint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and S CVE-2013-07789.3The ClusterIterator::NextCluster function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote CVE-2013-07799.3The nsCodingStateMachine::NextState function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows rem CVE-2013-07809.3Use-after-free vulnerability in the nsOverflowContinuationTracker::Finish function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 1 CVE-2013-07819.3Use-after-free vulnerability in the nsPrintEngine::CommonPrint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMo CVE-2013-07829.3Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0 CVE-2013-07839.3Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird befor CVE-2013-07849.3Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2 CVE-2013-07854.3Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.