Vulnerabilities > CVE-2013-1683 - Memory Corruption vulnerability in Mozilla Firefox/Thunderbird
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Vulnerable Configurations
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-556.NASL description MozillaFirefox was updated to Firefox 22.0 (bnc#825935) Following security issues were fixed : - MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards - MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer - MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL - MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler - MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event - MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks - MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure - MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior - MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements - MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses - MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context - MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia permission dialog incorrectly displays location - MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph domain spoofing in .com, .net and .name last seen 2020-06-05 modified 2014-06-13 plugin id 75073 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75073 title openSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1142-1) NASL family Windows NASL id MOZILLA_THUNDERBIRD_1707.NASL description The installed version of Thunderbird is a version prior to 17.0.7 and is, therefore, potentially affected by the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682, CVE-2013-1683) - Heap-use-after-free errors exist related to last seen 2020-06-01 modified 2020-06-02 plugin id 66994 published 2013-06-26 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66994 title Mozilla Thunderbird < 17.0.7 Multiple Vulnerabilities NASL family MacOS X Local Security Checks NASL id MACOSX_FIREFOX_22.NASL description The installed version of Firefox is earlier than 22.0 and is, therefore, potentially affected by multiple vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682, CVE-2013-1683) - Heap-use-after-free errors exist related to last seen 2020-06-01 modified 2020-06-02 plugin id 66989 published 2013-06-26 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66989 title Firefox < 22.0 Multiple Vulnerabilities (Mac OS X) NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-574.NASL description seamonkey was updated to 2.19 (bnc#825935) to fix bugs and security issues. Security issues fixed : - MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards - MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer - MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL - MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler - MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event - MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks - MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure - MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior - MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements - MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses - MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context - MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia permission dialog incorrectly displays location - MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph domain spoofing in .com, .net and .name last seen 2020-06-05 modified 2014-06-13 plugin id 75081 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75081 title openSUSE Security Update : seamonkey (openSUSE-SU-2013:1180-1) NASL family MacOS X Local Security Checks NASL id MACOSX_THUNDERBIRD_17_0_7.NASL description The installed version of Thunderbird is earlier than 17.0.7 and is, therefore, potentially affected by the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682, CVE-2013-1683) - Heap-use-after-free errors exist related to last seen 2020-06-01 modified 2020-06-02 plugin id 66990 published 2013-06-26 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66990 title Thunderbird < 17.0.7 Multiple Vulnerabilities (Mac OS X) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1890-1.NASL description Multiple memory safety issues were discovered in Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1682, CVE-2013-1683) Abhishek Arya discovered multiple use-after-free bugs. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1684, CVE-2013-1685, CVE-2013-1686) Mariusz Mlynski discovered that user defined code within the XBL scope of an element could be made to bypass System Only Wrappers (SOW). An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1687) Mariusz Mlynski discovered that the profiler user interface incorrectly handled data from the profiler. If the user examined profiler output on a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1688) A crash was discovered when reloading a page that contained content using the onreadystatechange event. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox (CVE-2013-1690) Johnathan Kuskos discovered that Firefox sent data in the body of XMLHttpRequest HEAD requests. An attacker could exploit this to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Paul Stone discovered a timing flaw in the processing of SVG images with filters. An attacker could exploit this to view sensitive information. (CVE-2013-1693) Boris Zbarsky discovered a flaw in PreserveWrapper. An attacker could potentially exploit this to cause a denial of service via application crash, or execute code with the privileges of the user invoking Firefox. (CVE-2013-1694) Bob Owen discovered that a sandboxed iframe could use a frame element to bypass its own restrictions. (CVE-2013-1695) Frederic Buclin discovered that the X-Frame-Options header is ignored in multi-part responses. An attacker could potentially exploit this to conduct clickjacking attacks. (CVE-2013-1696) It was discovered that XrayWrappers could be bypassed to call content-defined methods in certain circumstances. An attacker could exploit this to cause undefined behaviour. (CVE-2013-1697) Matt Wobensmith discovered that the getUserMedia permission dialog displayed the wrong domain in certain circumstances. An attacker could potentially exploit this to trick the user in to giving a malicious site access to their microphone or camera. (CVE-2013-1698) It was discovered that the measures for preventing homograph attacks using Internationalized Domain Names (IDN) were not sufficient for certain Top Level Domains (TLD). An attacker could potentially exploit this to conduct URL spoofing and phishing attacks. (CVE-2013-1699). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67000 published 2013-06-27 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67000 title Ubuntu 12.04 LTS / 12.10 / 13.04 : firefox vulnerabilities (USN-1890-1) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1890-2.NASL description USN-1890-1 fixed vulnerabilities in Firefox. This update introduced a regression which sometimes resulted in Firefox using the wrong network proxy settings. This update fixes the problem. We apologize for the inconvenience. Multiple memory safety issues were discovered in Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1682, CVE-2013-1683) Abhishek Arya discovered multiple use-after-free bugs. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1684, CVE-2013-1685, CVE-2013-1686) Mariusz Mlynski discovered that user defined code within the XBL scope of an element could be made to bypass System Only Wrappers (SOW). An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1687) Mariusz Mlynski discovered that the profiler user interface incorrectly handled data from the profiler. If the user examined profiler output on a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1688) A crash was discovered when reloading a page that contained content using the onreadystatechange event. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox (CVE-2013-1690) Johnathan Kuskos discovered that Firefox sent data in the body of XMLHttpRequest HEAD requests. An attacker could exploit this to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Paul Stone discovered a timing flaw in the processing of SVG images with filters. An attacker could exploit this to view sensitive information. (CVE-2013-1693) Boris Zbarsky discovered a flaw in PreserveWrapper. An attacker could potentially exploit this to cause a denial of service via application crash, or execute code with the privileges of the user invoking Firefox. (CVE-2013-1694) Bob Owen discovered that a sandboxed iframe could use a frame element to bypass its own restrictions. (CVE-2013-1695) Frederic Buclin discovered that the X-Frame-Options header is ignored in multi-part responses. An attacker could potentially exploit this to conduct clickjacking attacks. (CVE-2013-1696) It was discovered that XrayWrappers could be bypassed to call content-defined methods in certain circumstances. An attacker could exploit this to cause undefined behaviour. (CVE-2013-1697) Matt Wobensmith discovered that the getUserMedia permission dialog displayed the wrong domain in certain circumstances. An attacker could potentially exploit this to trick the user in to giving a malicious site access to their microphone or camera. (CVE-2013-1698) It was discovered that the measures for preventing homograph attacks using Internationalized Domain Names (IDN) were not sufficient for certain Top Level Domains (TLD). An attacker could potentially exploit this to conduct URL spoofing and phishing attacks. (CVE-2013-1699). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67186 published 2013-07-05 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67186 title Ubuntu 12.04 LTS / 12.10 / 13.04 : firefox regression (USN-1890-2) NASL family Windows NASL id MOZILLA_FIREFOX_22.NASL description The installed version of Firefox is earlier than 22.0 and is, therefore, potentially affected by the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682, CVE-2013-1683) - Heap-use-after-free errors exist related to last seen 2020-06-01 modified 2020-06-02 plugin id 66993 published 2013-06-26 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66993 title Firefox < 22.0 Multiple Vulnerabilities NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_B3FCB387DE4B11E2B1C60025905A4771.NASL description The Mozilla Project reports : Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7) Title: Memory corruption found using Address Sanitizer Privileged content access and execution via XBL Arbitrary code execution within Profiler Execution of unmapped memory through onreadystatechange Data in the body of XHR HEAD requests leads to CSRF attacks SVG filters can lead to information disclosure PreserveWrapper has inconsistent behavior Sandbox restrictions not applied to nested frame elements X-Frame-Options ignored when using server push with multi-part responses XrayWrappers can be bypassed to run user defined methods in a privileged context getUserMedia permission dialog incorrectly displays location Homograph domain spoofing in .com, .net and .name Inaccessible updater can lead to local privilege escalation last seen 2020-06-01 modified 2020-06-02 plugin id 66999 published 2013-06-27 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66999 title FreeBSD : mozilla -- multiple vulnerabilities (b3fcb387-de4b-11e2-b1c6-0025905a4771)
Oval
| accepted | 2014-10-06T04:02:38.368-04:00 | ||||||||||||||||
| class | vulnerability | ||||||||||||||||
| contributors |
| ||||||||||||||||
| definition_extensions |
| ||||||||||||||||
| description | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. | ||||||||||||||||
| family | windows | ||||||||||||||||
| id | oval:org.mitre.oval:def:17173 | ||||||||||||||||
| status | accepted | ||||||||||||||||
| submitted | 2013-07-08T10:26:26.748+04:00 | ||||||||||||||||
| title | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors | ||||||||||||||||
| version | 23 |
References
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
- http://www.mozilla.org/security/announce/2013/mfsa2013-49.html
- http://www.ubuntu.com/usn/USN-1890-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=822941
- https://bugzilla.mozilla.org/show_bug.cgi?id=834732
- https://bugzilla.mozilla.org/show_bug.cgi?id=846615
- https://bugzilla.mozilla.org/show_bug.cgi?id=851418
- https://bugzilla.mozilla.org/show_bug.cgi?id=862182
- https://bugzilla.mozilla.org/show_bug.cgi?id=863454
- https://bugzilla.mozilla.org/show_bug.cgi?id=865569
- https://bugzilla.mozilla.org/show_bug.cgi?id=865883
- https://bugzilla.mozilla.org/show_bug.cgi?id=876458
- https://bugzilla.mozilla.org/show_bug.cgi?id=877287
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17173