CVE-2013-0758
Mozilla Firefox < 18.0 - Remote Code Execution via SVG and Plugin Interaction
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2013-0758. PoCs published by Metasploit.
AI-analyzed exploit summary This Metasploit module exploits CVE-2014-9390 in Git and Mercurial clients on case-insensitive file systems (e.g., Windows, macOS) by crafting a malicious repository that overwrites sensitive configuration files (e.g., Git hooks) to achieve arbitrary code execution.
Description
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.
Exploits (2)
This Metasploit module exploits CVE-2014-9390 in Git and Mercurial clients on case-insensitive file systems (e.g., Windows, macOS) by crafting a malicious repository that overwrites sensitive configuration files (e.g., Git hooks) to achieve arbitrary code execution.
This Metasploit module exploits CVE-2013-0758 and CVE-2013-0757 to achieve remote code execution on Firefox 17.0.1 by leveraging Flash to navigate a frame to a chrome:// URL and bypassing the Chrome Object Wrapper.