CVE-2013-0753

Mozilla Firefox <18 - Use After Free

Title source: llm

Description

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotewindows

https://www.exploit-db.com/exploits/27940

View Code ZIP pw:eip

metasploit WORKING POC NORMAL

by regenrecht, juan vazquez · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb

View Code ZIP pw:eip

References (12)

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2013-0144.html

[Third Party Advisory] http://rhn.redhat.com/errata/RHSA-2013-0145.html

[Vendor Advisory] http://www.mozilla.org/security/announce/2013/mfsa2013-16.html

[Third Party Advisory] http://www.ubuntu.com/usn/USN-1681-1

[Third Party Advisory] http://www.ubuntu.com/usn/USN-1681-2

[Third Party Advisory] http://www.ubuntu.com/usn/USN-1681-4

[Issue Tracking, Patch, Vendor Advisory] https://bugzilla.mozilla.org/show_bug.cgi?id=814001

[Third Party Advisory] https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17053

Scores

EPSS 0.8401

EPSS Percentile 99.3%

Details

CWE

CWE-416

Status published

Products (26)

canonical/ubuntu_linux 10.04

canonical/ubuntu_linux 11.10

canonical/ubuntu_linux 12.04

canonical/ubuntu_linux 12.10

mozilla/firefox < 18.0

mozilla/seamonkey < 2.15

mozilla/thunderbird < 17.0.2

mozilla/thunderbird_esr 10.0 - 10.0.12

opensuse/opensuse 11.4

opensuse/opensuse 12.1

... and 16 more

Published Jan 13, 2013

Tracked Since Feb 18, 2026