CVE-2013-1687

Firefox < 22.0 and Firefox ESR < 17.0.7 - Remote Code Execution via XBL Function Injection

Title source: llm
STIX 2.1

Description

The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site.

References (17)

Core 17
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0982.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-0981.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17117
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=866823
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1890-1
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1891-1
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=863933
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2716
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2720
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/60777

Scores

EPSS 0.0334
EPSS Percentile 87.3%

Details

CWE
CWE-264
Status published
Products (27)
mozilla/firefox 19.0
mozilla/firefox 19.0.1
mozilla/firefox 19.0.2
mozilla/firefox 20.0
mozilla/firefox 20.0.1
mozilla/firefox 17.0
mozilla/firefox 17.0.1
mozilla/firefox 17.0.2
mozilla/firefox 17.0.3
mozilla/firefox 17.0.4
... and 17 more
Published Jun 26, 2013
Tracked Since Feb 18, 2026