CVE-2013-1690

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 69,0%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada mozilla firefox, mozilla thunderbird +13 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 28 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

Rincian

Terbit di NVD

26 Juni 2013

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

EPSS (30 hari)

69,0% peluang dieksploitasi; lebih tinggi dari 99,3% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

Masuk KEV

28 Maret 2022

Tenggat CISA

18 April 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.mozilla.org/security/announce/2013/mfsa2013-53.html advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1690 pemerintah AS
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html mailing list · advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2013-0981.html advisory pihak ketiga
• http://rhn.redhat.com/errata/RHSA-2013-0982.html advisory pihak ketiga
• http://www.debian.org/security/2013/dsa-2716 mailing list · advisory pihak ketiga
• http://www.debian.org/security/2013/dsa-2720 mailing list · advisory pihak ketiga
• http://www.securityfocus.com/bid/60778 broken link · advisory pihak ketiga · vdb entry
• http://www.ubuntu.com/usn/USN-1890-1 advisory pihak ketiga
• http://www.ubuntu.com/usn/USN-1891-1 advisory pihak ketiga
• https://bugzilla.mozilla.org/show_bug.cgi?id=857883 issue tracking
• https://bugzilla.mozilla.org/show_bug.cgi?id=901365 issue tracking
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996 broken link