CVE-2013-1697

Firefox < 22.0 and Firefox ESR < 17.0.7 - Remote Code Execution via XrayWrapper DefaultValue

Title source: llm

Description

The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.

References (16)

Core 16

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0982.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2013-0981.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/60784

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=858101

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1890-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1891-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2013/mfsa2013-59.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2013/dsa-2716

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2013/dsa-2720

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html

Scores

EPSS 0.0317

EPSS Percentile 86.6%

Details

CWE

CWE-264

Status published

Products (27)

mozilla/firefox 19.0

mozilla/firefox 19.0.1

mozilla/firefox 19.0.2

mozilla/firefox 20.0

mozilla/firefox 20.0.1

mozilla/firefox 17.0

mozilla/firefox 17.0.1

mozilla/firefox 17.0.2

mozilla/firefox 17.0.3

mozilla/firefox 17.0.4

... and 17 more

Published Jun 26, 2013

Tracked Since Feb 18, 2026