CVE-2013-5599

Firefox < 25.0 and SeaMonkey < 2.22 - Use-After-Free via CANVAS Element and mozTextStyle Attribute

Title source: llm
STIX 2.1

Description

Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.

References (11)

Core 11
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1480.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2013-1476.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19315
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=915210
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201504-01
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2788
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2797

Scores

EPSS 0.0519
EPSS Percentile 91.5%

Details

Status published
Products (39)
mozilla/firefox 19.0
mozilla/firefox 19.0.1
mozilla/firefox 19.0.2
mozilla/firefox 20.0
mozilla/firefox 20.0.1
mozilla/firefox 21.0
mozilla/firefox 22.0
mozilla/firefox 23.0
mozilla/firefox 23.0.1
mozilla/firefox 17.0
... and 29 more
Published Oct 30, 2013
Tracked Since Feb 18, 2026