Vulnerabilities > CVE-2013-1694 - Improper Input Validation vulnerability in Mozilla products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
mozilla
CWE-20
nessus

Summary

The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag.

Vulnerable Configurations

Part Description Count
Application
Mozilla
428

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-556.NASL
    descriptionMozillaFirefox was updated to Firefox 22.0 (bnc#825935) Following security issues were fixed : - MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards - MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer - MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL - MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler - MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event - MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks - MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure - MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior - MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements - MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses - MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context - MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia permission dialog incorrectly displays location - MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph domain spoofing in .com, .net and .name
    last seen2020-06-05
    modified2014-06-13
    plugin id75073
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75073
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1142-1)
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_1707.NASL
    descriptionThe installed version of Thunderbird is a version prior to 17.0.7 and is, therefore, potentially affected by the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682, CVE-2013-1683) - Heap-use-after-free errors exist related to
    last seen2020-06-01
    modified2020-06-02
    plugin id66994
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66994
    titleMozilla Thunderbird < 17.0.7 Multiple Vulnerabilities
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_1707_ESR.NASL
    descriptionThe installed version of Firefox ESR 17.x is earlier than 17.0.7, and is, therefore, potentially affected by the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682) - Heap-use-after-free errors exist related to
    last seen2020-06-01
    modified2020-06-02
    plugin id66992
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66992
    titleFirefox ESR 17.x < 17.0.7 Multiple Vulnerabilities
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_17_0_7_ESR.NASL
    descriptionThe installed version of Thunderbird ESR 17.x is prior to 17.0.7 and is, therefore, potentially affected the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682) - Heap-use-after-free errors exist related to
    last seen2020-06-01
    modified2020-06-02
    plugin id66991
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66991
    titleThunderbird ESR 17.x < 17.0.7 Multiple Vulnerabilities (Mac OS X)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_22.NASL
    descriptionThe installed version of Firefox is earlier than 22.0 and is, therefore, potentially affected by multiple vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682, CVE-2013-1683) - Heap-use-after-free errors exist related to
    last seen2020-06-01
    modified2020-06-02
    plugin id66989
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66989
    titleFirefox < 22.0 Multiple Vulnerabilities (Mac OS X)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2720.NASL
    descriptionMultiple security issues have been found in Icedove, Debian
    last seen2020-03-17
    modified2013-07-07
    plugin id67201
    published2013-07-07
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67201
    titleDebian DSA-2720-1 : icedove - several vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-574.NASL
    descriptionseamonkey was updated to 2.19 (bnc#825935) to fix bugs and security issues. Security issues fixed : - MFSA 2013-49/CVE-2013-1682/CVE-2013-1683 Miscellaneous memory safety hazards - MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer - MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL - MFSA 2013-52/CVE-2013-1688 (bmo#873966) Arbitrary code execution within Profiler - MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event - MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks - MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure - MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior - MFSA 2013-57/CVE-2013-1695 (bmo#849791) Sandbox restrictions not applied to nested frame elements - MFSA 2013-58/CVE-2013-1696 (bmo#761667) X-Frame-Options ignored when using server push with multi-part responses - MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context - MFSA 2013-60/CVE-2013-1698 (bmo#876044) getUserMedia permission dialog incorrectly displays location - MFSA 2013-61/CVE-2013-1699 (bmo#840882) Homograph domain spoofing in .com, .net and .name
    last seen2020-06-05
    modified2014-06-13
    plugin id75081
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75081
    titleopenSUSE Security Update : seamonkey (openSUSE-SU-2013:1180-1)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_17_0_7.NASL
    descriptionThe installed version of Thunderbird is earlier than 17.0.7 and is, therefore, potentially affected by the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682, CVE-2013-1683) - Heap-use-after-free errors exist related to
    last seen2020-06-01
    modified2020-06-02
    plugin id66990
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66990
    titleThunderbird < 17.0.7 Multiple Vulnerabilities (Mac OS X)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2013-0981.NASL
    descriptionFrom Red Hat Security Advisory 2013:0981 : Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690) It was found that Firefox allowed data to be sent in the body of XMLHttpRequest (XHR) HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Timing differences in the way Firefox processed SVG image files could allow an attacker to read data across domains, potentially leading to information disclosure. (CVE-2013-1693) Two flaws were found in the way Firefox implemented some of its internal structures (called wrappers). An attacker could use these flaws to bypass some restrictions placed on them. This could lead to unexpected behavior or a potentially exploitable crash. (CVE-2013-1694, CVE-2013-1697) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Jesse Ruderman, Andrew McCreight, Abhishek Arya, Mariusz Mlynski, Nils, Johnathan Kuskos, Paul Stone, Boris Zbarsky, and moz_bug_r_a4 as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 17.0.7 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 17.0.7 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-07-12
    plugin id68839
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68839
    titleOracle Linux 5 / 6 : firefox (ELSA-2013-0981)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_17_0_7_ESR.NASL
    descriptionThe installed version of Firefox ESR 17.x is earlier than 17.0.7 and is, therefore, potentially affected by the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682) - Heap-use-after-free errors exist related to
    last seen2020-06-01
    modified2020-06-02
    plugin id66988
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66988
    titleFirefox ESR 17.x < 17.0.7 Multiple Vulnerabilities (Mac OS X)
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_1707_ESR.NASL
    descriptionThe installed version of Thunderbird ESR 17.x is earlier than 17.0.7 and is, therefore, potentially affected the following vulnerabilities: - Various, unspecified memory safety issues exist. (CVE-2013-1682) - Heap-use-after-free errors exist related to
    last seen2020-06-01
    modified2020-06-02
    plugin id66995
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66995
    titleMozilla Thunderbird ESR 17.x < 17.0.7 Multiple Vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1891-1.NASL
    descriptionMultiple memory safety issues were discovered in Thunderbird. If the user were tricked into opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1682) Abhishek Arya discovered multiple use-after-free bugs. If the user were tricked into opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1684, CVE-2013-1685, CVE-2013-1686) Mariusz Mlynski discovered that user defined code within the XBL scope of an element could be made to bypass System Only Wrappers (SOW). If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1687) A crash was discovered when reloading a page that contained content using the onreadystatechange event. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1690) Johnathan Kuskos discovered that Thunderbird sent data in the body of XMLHttpRequest HEAD requests. If a user had scripting enabled, an attacker could exploit this to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Paul Stone discovered a timing flaw in the processing of SVG images with filters. If a user had scripting enabled, an attacker could exploit this to view sensitive information. (CVE-2013-1693) Boris Zbarsky discovered a flaw in PreserveWrapper. If a user had scripting enabled, an attacker could potentially exploit this to cause a denial of service via application crash, or execute code with the privileges of the user invoking Thunderbird. (CVE-2013-1694) It was discovered that XrayWrappers could be bypassed to call content-defined methods in certain circumstances. If a user had scripting enabled, an attacker could exploit this to cause undefined behaviour. (CVE-2013-1697). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id67001
    published2013-06-27
    reporterUbuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67001
    titleUbuntu 12.04 LTS / 12.10 / 13.04 : thunderbird vulnerabilities (USN-1891-1)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2013-0981.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690) It was found that Firefox allowed data to be sent in the body of XMLHttpRequest (XHR) HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Timing differences in the way Firefox processed SVG image files could allow an attacker to read data across domains, potentially leading to information disclosure. (CVE-2013-1693) Two flaws were found in the way Firefox implemented some of its internal structures (called wrappers). An attacker could use these flaws to bypass some restrictions placed on them. This could lead to unexpected behavior or a potentially exploitable crash. (CVE-2013-1694, CVE-2013-1697) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Jesse Ruderman, Andrew McCreight, Abhishek Arya, Mariusz Mlynski, Nils, Johnathan Kuskos, Paul Stone, Boris Zbarsky, and moz_bug_r_a4 as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 17.0.7 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 17.0.7 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-06-26
    plugin id66979
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66979
    titleRHEL 5 / 6 : firefox (RHSA-2013:0981)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2716.NASL
    descriptionMultiple security issues have been found in Iceweasel, Debian
    last seen2020-03-17
    modified2013-06-29
    plugin id67101
    published2013-06-29
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67101
    titleDebian DSA-2716-1 : iceweasel - several vulnerabilities
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20130625_THUNDERBIRD_ON_SL5_X.NASL
    descriptionSeveral flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690) It was found that Thunderbird allowed data to be sent in the body of XMLHttpRequest (XHR) HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Timing differences in the way Thunderbird processed SVG image files could allow an attacker to read data across domains, potentially leading to information disclosure. (CVE-2013-1693) Two flaws were found in the way Thunderbird implemented some of its internal structures (called wrappers). An attacker could use these flaws to bypass some restrictions placed on them. This could lead to unexpected behavior or a potentially exploitable crash. (CVE-2013-1694, CVE-2013-1697) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. 0.7 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen2020-03-18
    modified2013-06-26
    plugin id66984
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66984
    titleScientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/x86_64 (20130625)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-554.NASL
    descriptionMozillaThunderbird was updated to Thunderbird 17.0.7 (bnc#825935) Security issues fixed : - MFSA 2013-49/CVE-2013-1682 Miscellaneous memory safety hazards - MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer - MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL - MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event - MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks - MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure - MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior - MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context
    last seen2020-06-05
    modified2014-06-13
    plugin id75071
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75071
    titleopenSUSE Security Update : MozillaThunderbird (openSUSE-SU-2013:1141-1)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20130625_FIREFOX_ON_SL5_X.NASL
    descriptionSeveral flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690) It was found that Firefox allowed data to be sent in the body of XMLHttpRequest (XHR) HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Timing differences in the way Firefox processed SVG image files could allow an attacker to read data across domains, potentially leading to information disclosure. (CVE-2013-1693) Two flaws were found in the way Firefox implemented some of its internal structures (called wrappers). An attacker could use these flaws to bypass some restrictions placed on them. This could lead to unexpected behavior or a potentially exploitable crash. (CVE-2013-1694, CVE-2013-1697) 0.7 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen2020-03-18
    modified2013-06-26
    plugin id66983
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66983
    titleScientific Linux Security Update : firefox on SL5.x, SL6.x i386/x86_64 (20130625)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2013-0981.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690) It was found that Firefox allowed data to be sent in the body of XMLHttpRequest (XHR) HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Timing differences in the way Firefox processed SVG image files could allow an attacker to read data across domains, potentially leading to information disclosure. (CVE-2013-1693) Two flaws were found in the way Firefox implemented some of its internal structures (called wrappers). An attacker could use these flaws to bypass some restrictions placed on them. This could lead to unexpected behavior or a potentially exploitable crash. (CVE-2013-1694, CVE-2013-1697) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Jesse Ruderman, Andrew McCreight, Abhishek Arya, Mariusz Mlynski, Nils, Johnathan Kuskos, Paul Stone, Boris Zbarsky, and moz_bug_r_a4 as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 17.0.7 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 17.0.7 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id66996
    published2013-06-27
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66996
    titleCentOS 5 / 6 : firefox / xulrunner (CESA-2013:0981)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1890-1.NASL
    descriptionMultiple memory safety issues were discovered in Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1682, CVE-2013-1683) Abhishek Arya discovered multiple use-after-free bugs. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1684, CVE-2013-1685, CVE-2013-1686) Mariusz Mlynski discovered that user defined code within the XBL scope of an element could be made to bypass System Only Wrappers (SOW). An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1687) Mariusz Mlynski discovered that the profiler user interface incorrectly handled data from the profiler. If the user examined profiler output on a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1688) A crash was discovered when reloading a page that contained content using the onreadystatechange event. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox (CVE-2013-1690) Johnathan Kuskos discovered that Firefox sent data in the body of XMLHttpRequest HEAD requests. An attacker could exploit this to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Paul Stone discovered a timing flaw in the processing of SVG images with filters. An attacker could exploit this to view sensitive information. (CVE-2013-1693) Boris Zbarsky discovered a flaw in PreserveWrapper. An attacker could potentially exploit this to cause a denial of service via application crash, or execute code with the privileges of the user invoking Firefox. (CVE-2013-1694) Bob Owen discovered that a sandboxed iframe could use a frame element to bypass its own restrictions. (CVE-2013-1695) Frederic Buclin discovered that the X-Frame-Options header is ignored in multi-part responses. An attacker could potentially exploit this to conduct clickjacking attacks. (CVE-2013-1696) It was discovered that XrayWrappers could be bypassed to call content-defined methods in certain circumstances. An attacker could exploit this to cause undefined behaviour. (CVE-2013-1697) Matt Wobensmith discovered that the getUserMedia permission dialog displayed the wrong domain in certain circumstances. An attacker could potentially exploit this to trick the user in to giving a malicious site access to their microphone or camera. (CVE-2013-1698) It was discovered that the measures for preventing homograph attacks using Internationalized Domain Names (IDN) were not sufficient for certain Top Level Domains (TLD). An attacker could potentially exploit this to conduct URL spoofing and phishing attacks. (CVE-2013-1699). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id67000
    published2013-06-27
    reporterUbuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67000
    titleUbuntu 12.04 LTS / 12.10 / 13.04 : firefox vulnerabilities (USN-1890-1)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2013-0982.NASL
    descriptionFrom Red Hat Security Advisory 2013:0982 : An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690) It was found that Thunderbird allowed data to be sent in the body of XMLHttpRequest (XHR) HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Timing differences in the way Thunderbird processed SVG image files could allow an attacker to read data across domains, potentially leading to information disclosure. (CVE-2013-1693) Two flaws were found in the way Thunderbird implemented some of its internal structures (called wrappers). An attacker could use these flaws to bypass some restrictions placed on them. This could lead to unexpected behavior or a potentially exploitable crash. (CVE-2013-1694, CVE-2013-1697) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Jesse Ruderman, Andrew McCreight, Abhishek Arya, Mariusz Mlynski, Nils, Johnathan Kuskos, Paul Stone, Boris Zbarsky, and moz_bug_r_a4 as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 17.0.7 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-07-12
    plugin id68840
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68840
    titleOracle Linux 6 : thunderbird (ELSA-2013-0982)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-555.NASL
    descriptionMozilla xulrunner was update to 17.0.7esr (bnc#825935) Security issues fixed : - MFSA 2013-49/CVE-2013-1682 Miscellaneous memory safety hazards - MFSA 2013-50/CVE-2013-1684/CVE-2013-1685/CVE-2013-1686 Memory corruption found using Address Sanitizer - MFSA 2013-51/CVE-2013-1687 (bmo#863933, bmo#866823) Privileged content access and execution via XBL - MFSA 2013-53/CVE-2013-1690 (bmo#857883) Execution of unmapped memory through onreadystatechange event - MFSA 2013-54/CVE-2013-1692 (bmo#866915) Data in the body of XHR HEAD requests leads to CSRF attacks - MFSA 2013-55/CVE-2013-1693 (bmo#711043) SVG filters can lead to information disclosure - MFSA 2013-56/CVE-2013-1694 (bmo#848535) PreserveWrapper has inconsistent behavior - MFSA 2013-59/CVE-2013-1697 (bmo#858101) XrayWrappers can be bypassed to run user defined methods in a privileged context
    last seen2020-06-05
    modified2014-06-13
    plugin id75072
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75072
    titleopenSUSE Security Update : xulrunner (openSUSE-SU-2013:1143-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1890-2.NASL
    descriptionUSN-1890-1 fixed vulnerabilities in Firefox. This update introduced a regression which sometimes resulted in Firefox using the wrong network proxy settings. This update fixes the problem. We apologize for the inconvenience. Multiple memory safety issues were discovered in Firefox. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1682, CVE-2013-1683) Abhishek Arya discovered multiple use-after-free bugs. If the user were tricked into opening a specially crafted page, an attacker could possibly exploit these to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1684, CVE-2013-1685, CVE-2013-1686) Mariusz Mlynski discovered that user defined code within the XBL scope of an element could be made to bypass System Only Wrappers (SOW). An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1687) Mariusz Mlynski discovered that the profiler user interface incorrectly handled data from the profiler. If the user examined profiler output on a specially crafted page, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1688) A crash was discovered when reloading a page that contained content using the onreadystatechange event. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox (CVE-2013-1690) Johnathan Kuskos discovered that Firefox sent data in the body of XMLHttpRequest HEAD requests. An attacker could exploit this to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Paul Stone discovered a timing flaw in the processing of SVG images with filters. An attacker could exploit this to view sensitive information. (CVE-2013-1693) Boris Zbarsky discovered a flaw in PreserveWrapper. An attacker could potentially exploit this to cause a denial of service via application crash, or execute code with the privileges of the user invoking Firefox. (CVE-2013-1694) Bob Owen discovered that a sandboxed iframe could use a frame element to bypass its own restrictions. (CVE-2013-1695) Frederic Buclin discovered that the X-Frame-Options header is ignored in multi-part responses. An attacker could potentially exploit this to conduct clickjacking attacks. (CVE-2013-1696) It was discovered that XrayWrappers could be bypassed to call content-defined methods in certain circumstances. An attacker could exploit this to cause undefined behaviour. (CVE-2013-1697) Matt Wobensmith discovered that the getUserMedia permission dialog displayed the wrong domain in certain circumstances. An attacker could potentially exploit this to trick the user in to giving a malicious site access to their microphone or camera. (CVE-2013-1698) It was discovered that the measures for preventing homograph attacks using Internationalized Domain Names (IDN) were not sufficient for certain Top Level Domains (TLD). An attacker could potentially exploit this to conduct URL spoofing and phishing attacks. (CVE-2013-1699). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id67186
    published2013-07-05
    reporterUbuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67186
    titleUbuntu 12.04 LTS / 12.10 / 13.04 : firefox regression (USN-1890-2)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_22.NASL
    descriptionThe installed version of Firefox is earlier than 22.0 and is, therefore, potentially affected by the following vulnerabilities : - Various, unspecified memory safety issues exist. (CVE-2013-1682, CVE-2013-1683) - Heap-use-after-free errors exist related to
    last seen2020-06-01
    modified2020-06-02
    plugin id66993
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66993
    titleFirefox < 22.0 Multiple Vulnerabilities
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201309-23.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201309-23 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Further, a remote attacker could conduct XSS attacks, spoof URLs, bypass address space layout randomization, conduct clickjacking attacks, obtain potentially sensitive information, bypass access restrictions, modify the local filesystem, or conduct other unspecified attacks. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id70183
    published2013-09-28
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/70183
    titleGLSA-201309-23 : Mozilla Products: Multiple vulnerabilities
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2013-0982.NASL
    descriptionAn updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690) It was found that Thunderbird allowed data to be sent in the body of XMLHttpRequest (XHR) HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Timing differences in the way Thunderbird processed SVG image files could allow an attacker to read data across domains, potentially leading to information disclosure. (CVE-2013-1693) Two flaws were found in the way Thunderbird implemented some of its internal structures (called wrappers). An attacker could use these flaws to bypass some restrictions placed on them. This could lead to unexpected behavior or a potentially exploitable crash. (CVE-2013-1694, CVE-2013-1697) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Jesse Ruderman, Andrew McCreight, Abhishek Arya, Mariusz Mlynski, Nils, Johnathan Kuskos, Paul Stone, Boris Zbarsky, and moz_bug_r_a4 as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 17.0.7 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-06-27
    plugin id66997
    published2013-06-27
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66997
    titleCentOS 5 / 6 : thunderbird (CESA-2013:0982)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2013-0982.NASL
    descriptionAn updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1682, CVE-2013-1684, CVE-2013-1685, CVE-2013-1686, CVE-2013-1687, CVE-2013-1690) It was found that Thunderbird allowed data to be sent in the body of XMLHttpRequest (XHR) HEAD requests. In some cases this could allow attackers to conduct Cross-Site Request Forgery (CSRF) attacks. (CVE-2013-1692) Timing differences in the way Thunderbird processed SVG image files could allow an attacker to read data across domains, potentially leading to information disclosure. (CVE-2013-1693) Two flaws were found in the way Thunderbird implemented some of its internal structures (called wrappers). An attacker could use these flaws to bypass some restrictions placed on them. This could lead to unexpected behavior or a potentially exploitable crash. (CVE-2013-1694, CVE-2013-1697) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Gary Kwong, Jesse Ruderman, Andrew McCreight, Abhishek Arya, Mariusz Mlynski, Nils, Johnathan Kuskos, Paul Stone, Boris Zbarsky, and moz_bug_r_a4 as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 17.0.7 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-06-26
    plugin id66980
    published2013-06-26
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66980
    titleRHEL 5 / 6 : thunderbird (RHSA-2013:0982)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_B3FCB387DE4B11E2B1C60025905A4771.NASL
    descriptionThe Mozilla Project reports : Miscellaneous memory safety hazards (rv:22.0 / rv:17.0.7) Title: Memory corruption found using Address Sanitizer Privileged content access and execution via XBL Arbitrary code execution within Profiler Execution of unmapped memory through onreadystatechange Data in the body of XHR HEAD requests leads to CSRF attacks SVG filters can lead to information disclosure PreserveWrapper has inconsistent behavior Sandbox restrictions not applied to nested frame elements X-Frame-Options ignored when using server push with multi-part responses XrayWrappers can be bypassed to run user defined methods in a privileged context getUserMedia permission dialog incorrectly displays location Homograph domain spoofing in .com, .net and .name Inaccessible updater can lead to local privilege escalation
    last seen2020-06-01
    modified2020-06-02
    plugin id66999
    published2013-06-27
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66999
    titleFreeBSD : mozilla -- multiple vulnerabilities (b3fcb387-de4b-11e2-b1c6-0025905a4771)

Oval

accepted2014-10-06T04:02:39.312-04:00
classvulnerability
contributors
  • nameSergey Artykhov
    organizationALTX-SOFT
  • nameShane Shaffer
    organizationG2, Inc.
  • nameRichard Helbing
    organizationbaramundi software
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
definition_extensions
  • commentMozilla Thunderbird Mainline release is installed
    ovaloval:org.mitre.oval:def:22093
  • commentMozilla Firefox Mainline release is installed
    ovaloval:org.mitre.oval:def:22259
  • commentMozilla Firefox ESR is installed
    ovaloval:org.mitre.oval:def:22414
  • commentMozilla Thunderbird ESR is installed
    ovaloval:org.mitre.oval:def:22216
descriptionThe PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag.
familywindows
idoval:org.mitre.oval:def:17405
statusaccepted
submitted2013-07-08T10:26:26.748+04:00
titleThe PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag
version30

Redhat

advisories
  • rhsa
    idRHSA-2013:0981
  • rhsa
    idRHSA-2013:0982
rpms
  • firefox-0:17.0.7-1.el5_9
  • firefox-0:17.0.7-1.el6_4
  • firefox-debuginfo-0:17.0.7-1.el5_9
  • firefox-debuginfo-0:17.0.7-1.el6_4
  • xulrunner-0:17.0.7-1.el5_9
  • xulrunner-0:17.0.7-1.el6_4
  • xulrunner-debuginfo-0:17.0.7-1.el5_9
  • xulrunner-debuginfo-0:17.0.7-1.el6_4
  • xulrunner-devel-0:17.0.7-1.el5_9
  • xulrunner-devel-0:17.0.7-1.el6_4
  • thunderbird-0:17.0.7-1.el5_9
  • thunderbird-0:17.0.7-1.el6_4
  • thunderbird-debuginfo-0:17.0.7-1.el5_9
  • thunderbird-debuginfo-0:17.0.7-1.el6_4