CVE-2013-0787

Mozilla Firefox <19.0.2 - Use After Free

Title source: llm
STIX 2.1

Description

Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call.

References (16)

Core 16
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0627.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1758-1
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2699
Various Sources x_refsource_misc
http://twitter.com/VUPEN/statuses/309505403631325184
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/58391
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=848644
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0614.html

Scores

EPSS 0.0640
EPSS Percentile 92.9%

Details

CWE
CWE-399
Status published
Products (16)
mozilla/firefox 19.0
mozilla/firefox 17.0
mozilla/firefox 17.0.1
mozilla/firefox 17.0.2
mozilla/firefox 17.0.3
mozilla/firefox < 19.0.1
mozilla/seamonkey 2.16 beta1 (5 CPE variants)
mozilla/seamonkey < 2.16
mozilla/thunderbird 17.0
mozilla/thunderbird 17.0.1
... and 6 more
Published Mar 11, 2013
Tracked Since Feb 18, 2026