Description
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
Metrics
CVSS 3.1 8.8/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0981.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0982.htmlThird Party Advisory
- http://www.debian.org/security/2013/dsa-2716Mailing List, Third Party Advisory
- http://www.debian.org/security/2013/dsa-2720Mailing List, Third Party Advisory
- http://www.mozilla.org/security/announce/2013/mfsa2013-53.htmlVendor Advisory
- http://www.securityfocus.com/bid/60778Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1890-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1891-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=857883Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=901365Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0981.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0982.htmlThird Party Advisory
- http://www.debian.org/security/2013/dsa-2716Mailing List, Third Party Advisory
- http://www.debian.org/security/2013/dsa-2720Mailing List, Third Party Advisory
- http://www.mozilla.org/security/announce/2013/mfsa2013-53.htmlVendor Advisory
- http://www.securityfocus.com/bid/60778Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1890-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-1891-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=857883Issue Tracking
- https://bugzilla.mozilla.org/show_bug.cgi?id=901365Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1690US Government Resource
Timeline
- Published
- Jun 26, 2013
- Last modified
- Jun 16, 2026
- Added to CISA KEV
- Mar 28, 2022
- NVD status
- Analyzed