Vulnerabilities > CVE-2013-1722 - Resource Management Errors vulnerability in Mozilla products

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
mozilla
CWE-399
critical
nessus

Summary

Use-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Manager in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving stylesheet cloning.

Vulnerable Configurations

Part Description Count
Application
Mozilla
626

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2013-1268.NASL
    descriptionFrom Red Hat Security Advisory 2013:1268 : Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Firefox handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 17.0.9 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 17.0.9 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-09-18
    plugin id69940
    published2013-09-18
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69940
    titleOracle Linux 5 / 6 : firefox (ELSA-2013-1268)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Red Hat Security Advisory RHSA-2013:1268 and 
    # Oracle Linux Security Advisory ELSA-2013-1268 respectively.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(69940);
      script_version("1.19");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/29");
    
      script_cve_id("CVE-2013-1718", "CVE-2013-1722", "CVE-2013-1725", "CVE-2013-1730", "CVE-2013-1732", "CVE-2013-1735", "CVE-2013-1736", "CVE-2013-1737");
      script_bugtraq_id(62463, 62467, 62478, 62479);
      script_xref(name:"RHSA", value:"2013:1268");
    
      script_name(english:"Oracle Linux 5 / 6 : firefox (ELSA-2013-1268)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote Oracle Linux host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "From Red Hat Security Advisory 2013:1268 :
    
    Updated firefox packages that fix several security issues are now
    available for Red Hat Enterprise Linux 5 and 6.
    
    The Red Hat Security Response Team has rated this update as having
    critical security impact. Common Vulnerability Scoring System (CVSS)
    base scores, which give detailed severity ratings, are available for
    each vulnerability from the CVE links in the References section.
    
    Mozilla Firefox is an open source web browser. XULRunner provides the
    XUL Runtime environment for Mozilla Firefox.
    
    Several flaws were found in the processing of malformed web content. A
    web page containing malicious content could cause Firefox to crash or,
    potentially, execute arbitrary code with the privileges of the user
    running Firefox. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725,
    CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736)
    
    A flaw was found in the way Firefox handled certain DOM JavaScript
    objects. An attacker could use this flaw to make JavaScript client or
    add-on code make incorrect, security sensitive decisions.
    (CVE-2013-1737)
    
    Red Hat would like to thank the Mozilla project for reporting these
    issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby
    Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki
    Helin, Nils, and Boris Zbarsky as the original reporters of these
    issues.
    
    For technical details regarding these flaws, refer to the Mozilla
    security advisories for Firefox 17.0.9 ESR. You can find a link to the
    Mozilla advisories in the References section of this erratum.
    
    All Firefox users should upgrade to these updated packages, which
    contain Firefox version 17.0.9 ESR, which corrects these issues. After
    installing the update, Firefox must be restarted for the changes to
    take effect."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2013-September/003669.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://oss.oracle.com/pipermail/el-errata/2013-September/003674.html"
      );
      script_set_attribute(
        attribute:"solution",
        value:"Update the affected firefox packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:firefox");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xulrunner");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:xulrunner-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:5");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:6");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2013/09/18");
      script_set_attribute(attribute:"patch_publication_date", value:"2013/09/18");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/09/18");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Oracle Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
    os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(5|6)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 5 / 6", "Oracle Linux " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && "ia64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
    
    flag = 0;
    if (rpm_check(release:"EL5", reference:"firefox-17.0.9-1.0.1.el5_9", allowmaj:TRUE)) flag++;
    if (rpm_check(release:"EL5", reference:"xulrunner-17.0.9-1.0.1.el5_9")) flag++;
    if (rpm_check(release:"EL5", reference:"xulrunner-devel-17.0.9-1.0.1.el5_9")) flag++;
    
    if (rpm_check(release:"EL6", reference:"firefox-17.0.9-1.0.1.el6_4", allowmaj:TRUE)) flag++;
    if (rpm_check(release:"EL6", reference:"xulrunner-17.0.9-1.0.1.el6_4")) flag++;
    if (rpm_check(release:"EL6", reference:"xulrunner-devel-17.0.9-1.0.1.el6_4")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "firefox / xulrunner / xulrunner-devel");
    }
    
  • NASL familyWindows
    NASL idSEAMONKEY_221.NASL
    descriptionThe installed version of SeaMonkey is earlier than 2.21 and thus, is potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737)
    last seen2020-06-01
    modified2020-06-02
    plugin id69996
    published2013-09-19
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69996
    titleSeaMonkey < 2.21 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(69996);
      script_version("1.10");
      script_cvs_date("Date: 2019/11/27");
    
      script_cve_id(
        "CVE-2013-1718",
        "CVE-2013-1719",
        "CVE-2013-1720",
        "CVE-2013-1721",
        "CVE-2013-1722",
        "CVE-2013-1723",
        "CVE-2013-1724",
        "CVE-2013-1725",
        "CVE-2013-1726",
        "CVE-2013-1728",
        "CVE-2013-1730",
        "CVE-2013-1732",
        "CVE-2013-1735",
        "CVE-2013-1736",
        "CVE-2013-1737",
        "CVE-2013-1738"
      );
      script_bugtraq_id(
        62460,
        62462,
        62463,
        62464,
        62465,
        62466,
        62467,
        62468,
        62469,
        62470,
        62472,
        62473,
        62475,
        62478,
        62479,
        62482
      );
    
      script_name(english:"SeaMonkey < 2.21 Multiple Vulnerabilities");
      script_summary(english:"Checks version of SeaMonkey");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a web browser that is potentially
    affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installed version of SeaMonkey is earlier than 2.21 and thus, is
    potentially affected by the following vulnerabilities :
    
      - Memory issues exist in the browser engine that could
        allow for denial of service or arbitrary code execution.
        (CVE-2013-1718, CVE-2013-1719)
    
      - The HTML5 Tree Builder does not properly maintain
        states, which could result in a denial of service or
        possible arbitrary code execution.  (CVE-2013-1720)
    
      - The ANGLE library is vulnerable to an integer overflow,
        which could result in a denial of service or arbitrary
        code execution. (CVE-2013-1721)
    
      - Multiple use-after-free problems exist, which could
        result in denial of service attacks or arbitrary code
        execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735,
        CVE-2013-1736, CVE-2013-1738)
    
      - The NativeKey widget does not properly terminate key
        messages, possibly leading to a denial of service
        attack. (CVE-2013-1723)
    
      - Incorrect scope handling for JavaScript objects with
        compartments could result in denial of service or
        possibly arbitrary code execution. (CVE-2013-1725)
    
      - Local users can gain the same privileges as the Mozilla
        Updater because the application does not ensure
        exclusive access to the update file. An attacker could
        exploit this by inserting a malicious file into the
        update file. (CVE-2013-1726)
    
      - Sensitive information can be obtained via unspecified
        vectors because the IonMonkey JavaScript does not
        properly initialize memory. (CVE-2013-1728)
    
      - A JavaScript compartment mismatch could result in a
        denial of service or arbitrary code execution. Versions
        of Firefox 20 or greater are not susceptible to the
        arbitrary code execution mentioned above.
        (CVE-2013-1730)
    
      - A buffer overflow is possible because of an issue with
        multi-column layouts. (CVE-2013-1732)
    
      - An object is not properly identified during use of
        user-defined getter methods on DOM proxies.  This could
        result in access restrictions being bypassed.
        (CVE-2013-1737)");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-76/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-77/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-78/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-79/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-80/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-81/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-82/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-83/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-85/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-86/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-88/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-89/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-90/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-91/");
      script_set_attribute(attribute:"see_also", value:"https://www.mozilla.org/en-US/security/advisories/mfsa2013-92/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to SeaMonkey 2.21 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-1736");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2013/09/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2013/09/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/09/19");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mozilla:seamonkey");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mozilla_org_installed.nasl");
      script_require_keys("SeaMonkey/Version");
    
      exit(0);
    }
    
    include("mozilla_version.inc");
    
    port = get_kb_item("SMB/transport");
    if (!port) port = 445;
    
    installs = get_kb_list("SMB/SeaMonkey/*");
    if (isnull(installs)) audit(AUDIT_NOT_INST, "SeaMonkey");
    
    mozilla_check_version(installs:installs, product:'seamonkey', fix:'2.21', severity:SECURITY_HOLE, xss:FALSE);
    
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-17074.NASL
    descriptionUpstream update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-09-23
    plugin id70062
    published2013-09-23
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/70062
    titleFedora 20 : firefox-24.0-1.fc20 / xulrunner-24.0-2.fc20 (2013-17074)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2013-1269.NASL
    descriptionFrom Red Hat Security Advisory 2013:1269 : An updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Thunderbird handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 17.0.9 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-09-18
    plugin id69941
    published2013-09-18
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69941
    titleOracle Linux 6 : thunderbird (ELSA-2013-1269)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-17047.NASL
    descriptionUpstream security update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-09-30
    plugin id70205
    published2013-09-30
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/70205
    titleFedora 18 : firefox-24.0-1.fc18 / xulrunner-24.0-2.fc18 (2013-17047)
  • NASL familyWindows
    NASL idMOZILLA_THUNDERBIRD_24.NASL
    descriptionThe installed version of Thunderbird is 17.x or later but prior to 24. It is, therefore, potentially affected the following vulnerabilities: - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737) - An input validation error exists related to email messages containing HTML and iframes and the action of replying to or forwarding such messages that could allow cross-site scripting attacks. (CVE-2013-6674) - An input validation error exists related to email messages containing HTML and object or embed elements that could allow cross-site scripting attacks. (CVE-2014-2018)
    last seen2020-06-01
    modified2020-06-02
    plugin id69995
    published2013-09-19
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69995
    titleMozilla Thunderbird 17.x through 23.x Multiple Vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-719.NASL
    descriptionThis MozillaThunderbird update to version 24.0 fixes several security and non-security issues : - update to Thunderbird 24.0 (bnc#840485) - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong
    last seen2020-06-05
    modified2014-06-13
    plugin id75150
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75150
    titleopenSUSE Security Update : MozillaThunderbird (openSUSE-SU-2013:1495-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1952-1.NASL
    descriptionMultiple memory safety issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message with scripting enabled, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1718) Atte Kettunen discovered a flaw in the HTML5 Tree Builder when interacting with template elements. If a user had scripting enabled, in some circumstances an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1720) Alex Chapman discovered an integer overflow vulnerability in the ANGLE library. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1721) Abhishek Arya discovered a use-after-free in the Animation Manager. If a user had scripting enabled, an attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1722) Scott Bell discovered a use-after-free when using a select element. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1724) It was discovered that the scope of new JavaScript objects could be accessed before their compartment is initialized. If a user had scripting enabled, an attacker could potentially exploit this to execute code with the privileges of the user invoking Thunderbird. (CVE-2013-1725) Dan Gohman discovered that some variables and data were used in IonMonkey, without being initialized, which could lead to information leakage. (CVE-2013-1728) Sachin Shinde discovered a crash when moving some XBL-backed nodes in to a document created by document.open(). If a user had scripting enabled, an attacker could potentially exploit this to cause a denial of service. (CVE-2013-1730) Aki Helin discovered a buffer overflow when combining lists, floats and multiple columns. If a user had scripting enabled, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1732) Two memory corruption bugs when scrolling were discovered. If a user had scripting enabled, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Thunderbird. (CVE-2013-1735, CVE-2013-1736) Boris Zbarsky discovered that user-defined getters on DOM proxies would use the expando object as
    last seen2020-06-01
    modified2020-06-02
    plugin id69970
    published2013-09-19
    reporterUbuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69970
    titleUbuntu 12.04 LTS / 12.10 / 13.04 : thunderbird vulnerabilities (USN-1952-1)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-819.NASL
    descriptionMozillaFirefox was updated to Firefox 25.0. MozillaThunderbird was updated to Thunderbird 24.1.0. Mozilla XULRunner was updated to 17.0.10esr. Mozilla NSPR was updated to 4.10.1. Changes in MozillaFirefox : - requires NSS 3.15.2 or above - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards - MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions - MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache - MFSA 2013-99/CVE-2013-5598 (bmo#920515) Security bypass of PDF.js checks using iframes - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers - MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates Changes in MozillaThunderbird : - requires NSS 3.15.2 or above - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards - MFSA 2013-94/CVE-2013-5593 (bmo#868327) Spoofing addressbar through SELECT element - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions - MFSA 2013-97/CVE-2013-5596 (bmo#910881) Writing to cycle collected object during image decoding - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers - MFSA 2013-102/CVE-2013-5603 (bmo#916404) Use-after-free in HTML document templates - update to Thunderbird 24.0.1 - fqdn for smtp server name was not accepted (bmo#913785) - fixed crash in PL_strncasecmp (bmo#917955) - update Enigmail to 1.6 - The passphrase timeout configuration in Enigmail is now read and written from/to gpg-agent. - New dialog to change the expiry date of keys - New function to search for the OpenPGP keys of all Address Book entries on a keyserver - removed obsolete enigmail-build.patch Changes in xulrunner : - update to 17.0.10esr (bnc#847708) - require NSS 3.14.4 or above - MFSA 2013-93/CVE-2013-5590/CVE-2013-5591/CVE-2013-5592 Miscellaneous memory safety hazards - MFSA 2013-95/CVE-2013-5604 (bmo#914017) Access violation with XSLT and uninitialized data - MFSA 2013-96/CVE-2013-5595 (bmo#916580) Improperly initialized memory and overflows in some JavaScript functions - MFSA 2013-98/CVE-2013-5597 (bmo#918864) Use-after-free when updating offline cache - MFSA 2013-100/CVE-2013-5599/CVE-2013-5600/CVE-2013-5601 (bmo#915210, bmo#915576, bmo#916685) Miscellaneous use-after-free issues found through ASAN fuzzing - MFSA 2013-101/CVE-2013-5602 (bmo#897678) Memory corruption in workers - update to 17.0.9esr (bnc#840485) - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests - MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety hazards - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong
    last seen2020-06-05
    modified2014-06-13
    plugin id75186
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75186
    titleopenSUSE Security Update : Mozilla Suite (openSUSE-SU-2013:1633-1)
  • NASL familyWindows
    NASL idMOZILLA_FIREFOX_24.NASL
    descriptionThe installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist that could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch can result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737)
    last seen2020-06-01
    modified2020-06-02
    plugin id69993
    published2013-09-19
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69993
    titleFirefox < 24.0 Multiple Vulnerabilities
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1951-1.NASL
    descriptionMultiple memory safety issues were discovered in Firefox. If a user were tricked in to opening a specially crafted page, an attacker could possibly exploit these to cause a denial of service via application crash, or potentially execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1718, CVE-2013-1719) Atte Kettunen discovered a flaw in the HTML5 Tree Builder when interacting with template elements. In some circumstances, an attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1720) Alex Chapman discovered an integer overflow vulnerability in the ANGLE library. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1721) Abhishek Arya discovered a use-after-free in the Animation Manager. An attacked could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1722) Scott Bell discovered a use-after-free when using a select element. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1724) It was discovered that the scope of new JavaScript objects could be accessed before their compartment is initialized. An attacker could potentially exploit this to execute code with the privileges of the user invoking Firefox. (CVE-2013-1725) Dan Gohman discovered that some variables and data were used in IonMonkey, without being initialized, which could lead to information leakage. (CVE-2013-1728) Sachin Shinde discovered a crash when moving some XBL-backed nodes in to a document created by document.open(). An attacker could potentially exploit this to cause a denial of service. (CVE-2013-1730) Aki Helin discovered a buffer overflow when combining lists, floats and multiple columns. An attacker could potentially exploit this to execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1732) Two memory corruption bugs when scrolling were discovered. An attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2013-1735, CVE-2013-1736) Boris Zbarsky discovered that user-defined getters on DOM proxies would use the expando object as
    last seen2020-06-01
    modified2020-06-02
    plugin id69947
    published2013-09-18
    reporterUbuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69947
    titleUbuntu 12.04 LTS / 12.10 / 13.04 : firefox vulnerabilities (USN-1951-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_11_MOZILLAFIREFOX-130919.NASL
    descriptionThis update to Firefox 17.0.9esr (bnc#840485) addresses : - User-defined properties on DOM proxies get the wrong
    last seen2020-06-05
    modified2013-09-28
    plugin id70189
    published2013-09-28
    reporterThis script is Copyright (C) 2013-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/70189
    titleSuSE 11.2 / 11.3 Security Update : Mozilla Firefox (SAT Patch Numbers 8344 / 8346)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_THUNDERBIRD_24_0.NASL
    descriptionThe installed version of Thunderbird is a version prior to 24.0. It is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments could result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker could exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch could result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This could result in access restrictions being bypassed. (CVE-2013-1737) - An input validation error exists related to email messages containing HTML and iframes and the action of replying to or forwarding such messages that could allow cross-site scripting attacks. (CVE-2013-6674) - An input validation error exists related to email messages containing HTML and object or embed elements that could allow cross-site scripting attacks. (CVE-2014-2018)
    last seen2020-06-01
    modified2020-06-02
    plugin id69991
    published2013-09-19
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69991
    titleThunderbird 17.x through 23.x Multiple Vulnerabilities (Mac OS X)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-718.NASL
    descriptionThis MozillaFirefox update to version 24.0 fixes several security and non-security issues : - move greek to the translations-common package (bnc#840551) - update to Firefox 24.0 (bnc#840485) - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow in ANGLE library - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong
    last seen2020-06-05
    modified2014-06-13
    plugin id75149
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75149
    titleopenSUSE Security Update : MozillaFirefox (openSUSE-SU-2013:1493-1)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20130917_THUNDERBIRD_ON_SL5_X.NASL
    descriptionSeveral flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Thunderbird handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add- on code make incorrect, security sensitive decisions. (CVE-2013-1737) Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen2020-03-18
    modified2013-09-18
    plugin id69946
    published2013-09-18
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69946
    titleScientific Linux Security Update : thunderbird on SL5.x, SL6.x i386/srpm/x86_64 (20130917)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2013-1269.NASL
    descriptionAn updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Thunderbird handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 17.0.9 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-09-18
    plugin id69944
    published2013-09-18
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69944
    titleRHEL 5 / 6 : thunderbird (RHSA-2013:1269)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-720.NASL
    descriptionThis seamonkey update to version 2.21 fixes several security and non-security issues : - update to SeaMonkey 2.21 (bnc#840485) - MFSA 2013-76/CVE-2013-1718/CVE-2013-1719 Miscellaneous memory safety hazards - MFSA 2013-77/CVE-2013-1720 (bmo#888820) Improper state in HTML5 Tree Builder with templates - MFSA 2013-78/CVE-2013-1721 (bmo#890277) Integer overflow in ANGLE library - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-80/CVE-2013-1723 (bmo#891292) NativeKey continues handling key messages after widget is destroyed - MFSA 2013-81/CVE-2013-1724 (bmo#894137) Use-after-free with select element - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-85/CVE-2013-1728 (bmo#883686) Uninitialized data in IonMonkey - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong
    last seen2020-06-05
    modified2014-06-13
    plugin id75151
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75151
    titleopenSUSE Security Update : seamonkey (openSUSE-SU-2013:1491-1)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20130917_FIREFOX_ON_SL5_X.NASL
    descriptionSeveral flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Firefox handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add- on code make incorrect, security sensitive decisions. (CVE-2013-1737) After installing the update, Firefox must be restarted for the changes to take effect.
    last seen2020-03-18
    modified2013-09-18
    plugin id69945
    published2013-09-18
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69945
    titleScientific Linux Security Update : firefox on SL5.x, SL6.x i386/srpm/x86_64 (20130917)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2759.NASL
    descriptionMultiple security issues have been found in Iceweasel, Debian
    last seen2020-03-17
    modified2013-09-19
    plugin id69959
    published2013-09-19
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69959
    titleDebian DSA-2759-1 : iceweasel - several vulnerabilities
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_7DFED67B20AA11E3B8D80025905A4771.NASL
    descriptionThe Mozilla Project reports : MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 / rv:17.0.9) MFSA 2013-77 Improper state in HTML5 Tree Builder with templates MFSA 2013-78 Integer overflow in ANGLE library MFSA 2013-79 Use-after-free in Animation Manager during stylesheet cloning MFSA 2013-80 NativeKey continues handling key messages after widget is destroyed MFSA 2013-81 Use-after-free with select element MFSA 2013-82 Calling scope for new JavaScript objects can lead to memory corruption MFSA 2013-83 Mozilla Updater does not lock MAR file after signature verification MFSA 2013-84 Same-origin bypass through symbolic links MFSA 2013-85 Uninitialized data in IonMonkey MFSA 2013-86 WebGL Information disclosure through OS X NVIDIA graphic drivers MFSA 2013-87 Shared object library loading from writable location MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes MFSA 2013-89 Buffer overflow with multi-column, lists, and floats MFSA 2013-90 Memory corruption involving scrolling MFSA 2013-91 User-defined properties on DOM proxies get the wrong
    last seen2020-06-01
    modified2020-06-02
    plugin id70262
    published2013-10-02
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/70262
    titleFreeBSD : mozilla -- multiple vulnerabilities (7dfed67b-20aa-11e3-b8d8-0025905a4771)
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2013-717.NASL
    descriptionThis xulrunner17 version update to 17.0.9esr fixes the following security issues (bnc#840485) : - MFSA 2013-65/CVE-2013-1705 (bmo#882865) Buffer underflow when generating CRMF requests - MFSA 2013-76/CVE-2013-1718 Miscellaneous memory safety hazards - MFSA 2013-79/CVE-2013-1722 (bmo#893308) Use-after-free in Animation Manager during stylesheet cloning - MFSA 2013-82/CVE-2013-1725 (bmo#876762) Calling scope for new JavaScript objects can lead to memory corruption - MFSA 2013-88/CVE-2013-1730 (bmo#851353) Compartment mismatch re-attaching XBL-backed nodes - MFSA 2013-89/CVE-2013-1732 (bmo#883514) Buffer overflow with multi-column, lists, and floats - MFSA 2013-90/CVE-2013-1735/CVE-2013-1736 (bmo#898871, bmo#906301) Memory corruption involving scrolling - MFSA 2013-91/CVE-2013-1737 (bmo#907727) User-defined properties on DOM proxies get the wrong
    last seen2020-06-05
    modified2014-06-13
    plugin id75148
    published2014-06-13
    reporterThis script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/75148
    titleopenSUSE Security Update : xulrunner17 (openSUSE-SU-2013:1496-1)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FIREFOX_24.NASL
    descriptionThe installed version of Firefox is earlier than 24.0 and is, therefore, potentially affected by multiple vulnerabilities : - Memory issues exist in the browser engine that could allow for denial of service or arbitrary code execution. (CVE-2013-1718, CVE-2013-1719) - The HTML5 Tree Builder does not properly maintain states, which could result in a denial of service or possible arbitrary code execution. (CVE-2013-1720) - The ANGLE library is vulnerable to an integer overflow, which could result in a denial of service or arbitrary code execution. (CVE-2013-1721) - Multiple use-after-free problems exist, which could result in denial of service attacks or arbitrary code execution. (CVE-2013-1722, CVE-2013-1724, CVE-2013-1735, CVE-2013-1736, CVE-2013-1738) - The NativeKey widget does not properly terminate key messages, possibly leading to a denial of service attack. (CVE-2013-1723) - Incorrect scope handling for JavaScript objects with compartments can result in denial of service or possibly arbitrary code execution. (CVE-2013-1725) - Local users can gain the same privileges as the Mozilla Updater because the application does not ensure exclusive access to the update file. An attacker can exploit this by inserting a malicious file into the update file. (CVE-2013-1726) - Sensitive information can be obtained via unspecified vectors because the IonMonkey JavaScript does not properly initialize memory. (CVE-2013-1728) - A JavaScript compartment mismatch can result in a denial of service or arbitrary code execution. Versions of Firefox 20 or greater are not susceptible to the arbitrary code execution mentioned above. (CVE-2013-1730) - A buffer overflow is possible because of an issue with multi-column layouts. (CVE-2013-1732) - An object is not properly identified during use of user-defined getter methods on DOM proxies. This can result in access restrictions being bypassed. (CVE-2013-1737) - An issue in the NVIDIA OS X graphic drivers allows the user
    last seen2020-06-01
    modified2020-06-02
    plugin id69989
    published2013-09-19
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69989
    titleFirefox < 24.0 Multiple Vulnerabilities (Mac OS X)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-16992.NASL
    descriptionUpstream security update. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-09-21
    plugin id70036
    published2013-09-21
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/70036
    titleFedora 19 : firefox-24.0-1.fc19 / xulrunner-24.0-2.fc19 (2013-16992)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2762.NASL
    descriptionMultiple security issues have been found in Icedove, Debian
    last seen2020-03-17
    modified2013-09-24
    plugin id70080
    published2013-09-24
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/70080
    titleDebian DSA-2762-1 : icedove - several vulnerabilities
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2013-1268.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Firefox handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 17.0.9 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 17.0.9 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id69936
    published2013-09-18
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69936
    titleCentOS 5 / 6 : firefox (CESA-2013:1268)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2013-1268.NASL
    descriptionUpdated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Firefox handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. For technical details regarding these flaws, refer to the Mozilla security advisories for Firefox 17.0.9 ESR. You can find a link to the Mozilla advisories in the References section of this erratum. All Firefox users should upgrade to these updated packages, which contain Firefox version 17.0.9 ESR, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-09-18
    plugin id69943
    published2013-09-18
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69943
    titleRHEL 5 / 6 : firefox (RHSA-2013:1268)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201309-23.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201309-23 (Mozilla Products: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Mozilla Firefox, Thunderbird, and SeaMonkey. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user to view a specially crafted web page or email, possibly resulting in execution of arbitrary code or a Denial of Service condition. Further, a remote attacker could conduct XSS attacks, spoof URLs, bypass address space layout randomization, conduct clickjacking attacks, obtain potentially sensitive information, bypass access restrictions, modify the local filesystem, or conduct other unspecified attacks. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id70183
    published2013-09-28
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/70183
    titleGLSA-201309-23 : Mozilla Products: Multiple vulnerabilities
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2013-1269.NASL
    descriptionAn updated thunderbird package that fixes several security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2013-1718, CVE-2013-1722, CVE-2013-1725, CVE-2013-1730, CVE-2013-1732, CVE-2013-1735, CVE-2013-1736) A flaw was found in the way Thunderbird handled certain DOM JavaScript objects. An attacker could use this flaw to make JavaScript client or add-on code make incorrect, security sensitive decisions. (CVE-2013-1737) Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Andre Bargull, Scoobidiver, Bobby Holley, Reuben Morais, Abhishek Arya, Ms2ger, Sachin Shinde, Aki Helin, Nils, and Boris Zbarsky as the original reporters of these issues. Note: All of the above issues cannot be exploited by a specially crafted HTML mail message as JavaScript is disabled by default for mail messages. They could be exploited another way in Thunderbird, for example, when viewing the full remote content of an RSS feed. All Thunderbird users should upgrade to this updated package, which contains Thunderbird version 17.0.9 ESR, which corrects these issues. After installing the update, Thunderbird must be restarted for the changes to take effect.
    last seen2020-05-31
    modified2013-09-18
    plugin id69937
    published2013-09-18
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/69937
    titleCentOS 5 / 6 : thunderbird (CESA-2013:1269)

Oval

accepted2014-10-06T04:02:46.884-04:00
classvulnerability
contributors
  • nameShane Shaffer
    organizationG2, Inc.
  • nameShane Shaffer
    organizationG2, Inc.
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Kedovskaya
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
  • nameMaria Mikhno
    organizationALTX-SOFT
  • nameRichard Helbing
    organizationbaramundi software
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
  • nameEvgeniy Pavlov
    organizationALTX-SOFT
definition_extensions
  • commentMozilla Firefox Mainline release is installed
    ovaloval:org.mitre.oval:def:22259
  • commentMozilla Thunderbird Mainline release is installed
    ovaloval:org.mitre.oval:def:22093
  • commentMozilla Seamonkey is installed
    ovaloval:org.mitre.oval:def:6372
  • commentMozilla Firefox ESR is installed
    ovaloval:org.mitre.oval:def:22414
  • commentMozilla Thunderbird ESR is installed
    ovaloval:org.mitre.oval:def:22216
descriptionUse-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Manager in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving stylesheet cloning.
familywindows
idoval:org.mitre.oval:def:19031
statusaccepted
submitted2013-09-18T21:23:33.068-04:00
titleUse-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Manager in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving stylesheet cloning.
version37

Redhat

advisories
  • rhsa
    idRHSA-2013:1268
  • rhsa
    idRHSA-2013:1269
rpms
  • firefox-0:17.0.9-1.el5_9
  • firefox-0:17.0.9-1.el6_4
  • firefox-debuginfo-0:17.0.9-1.el5_9
  • firefox-debuginfo-0:17.0.9-1.el6_4
  • xulrunner-0:17.0.9-1.el5_9
  • xulrunner-0:17.0.9-1.el6_4
  • xulrunner-debuginfo-0:17.0.9-1.el5_9
  • xulrunner-debuginfo-0:17.0.9-1.el6_4
  • xulrunner-devel-0:17.0.9-1.el5_9
  • xulrunner-devel-0:17.0.9-1.el6_4
  • thunderbird-0:17.0.9-1.el5_9
  • thunderbird-0:17.0.9-1.el6_4
  • thunderbird-debuginfo-0:17.0.9-1.el5_9
  • thunderbird-debuginfo-0:17.0.9-1.el6_4

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 62460 CVE(CAN) ID: CVE-2013-1722 Firefox是一款非常流行的开源WEB浏览器。Thunderbird是一个邮件客户端,支持IMAP、POP邮件协议以及HTML邮件格式。 Mozilla Firefox, SeaMonkey, Thunderbird的Animation Manager中,函数nsAnimationManager::BuildAnimations存在释放后重用漏洞,远程攻击者可通过样式表克隆方法,利用此漏洞执行任意代码或造成拒绝服务。 0 Mozilla Firefox &lt; 24.0 Mozilla Thunderbird &lt; 24.0 Mozilla SeaMonkey &lt; 2.21 厂商补丁: Mozilla ------- Mozilla已经为此发布了一个安全公告(mfsa2013-79)以及相应补丁: mfsa2013-79:Use-after-free in Animation Manager during stylesheet cloning 链接:http://www.mozilla.org/security/announce/2013/mfsa2013-79.html
idSSV:61042
last seen2017-11-19
modified2013-09-23
published2013-09-23
reporterRoot
titleMozilla Firefox/Thunderbird/SeaMonkey 远程代码执行漏洞(CVE-2013-1722)