Exploitation Summary
EIP tracks 3 public exploits for CVE-2013-0757.
PoCs published by Marius Mlynski, joev, sinn3r, including Metasploit module exploits/multi/browser/firefox_svg_plugin.
AI-analyzed exploit summary This Metasploit module exploits CVE-2014-9390 in Git and Mercurial clients on case-insensitive file systems by crafting a malicious repository that overwrites sensitive configuration files in the .git directory, leading to arbitrary code execution.
Description
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.
Exploits (3)
This Metasploit module exploits CVE-2014-9390 in Git and Mercurial clients on case-insensitive file systems by crafting a malicious repository that overwrites sensitive configuration files in the .git directory, leading to arbitrary code execution.
This Metasploit module exploits CVE-2013-0757 and CVE-2013-0758 to achieve remote code execution on Firefox 17.0.1 by leveraging Flash to navigate a frame to a chrome:// URL and bypassing the Chrome Object Wrapper.
This Metasploit module exploits CVE-2013-0757 and CVE-2013-0758 to achieve remote code execution on Firefox 17.0.1 by leveraging Flash to navigate a frame to a chrome:// URL and bypassing the Chrome Object Wrapper.