CVE-2013-1693

Firefox < 22.0 and Firefox ESR < 17.0.7 - Pixel Value Timing Side-Channel via SVG Filter

Title source: llm

Description

The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly bypass the Same Origin Policy and read text from a different domain, by observing timing differences in execution of filter code.

References (16)

Core 16

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0982.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0981.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17075

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1890-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1891-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/60787

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2013/dsa-2716

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2013/mfsa2013-55.html

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=711043

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2013/dsa-2720

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html

Scores

EPSS 0.0374

EPSS Percentile 88.6%

Details

CWE

CWE-264

Status published

Products (27)

mozilla/firefox 19.0

mozilla/firefox 19.0.1

mozilla/firefox 19.0.2

mozilla/firefox 20.0

mozilla/firefox 20.0.1

mozilla/firefox 17.0

mozilla/firefox 17.0.1

mozilla/firefox 17.0.2

mozilla/firefox 17.0.3

mozilla/firefox 17.0.4

... and 17 more

Published Jun 26, 2013

Tracked Since Feb 18, 2026