Vulnerability Details : CVE-2013-1697
The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
Exploit prediction scoring system (EPSS) score for CVE-2013-1697
Probability of exploitation activity in the next 30 days: 1.23%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 84 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-1697
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2013-1697
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-1697
-
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
[security-announce] openSUSE-SU-2013:1140-1: important: regular updates
-
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
[security-announce] openSUSE-SU-2013:1142-1: important: MozillaFirefox:
-
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html
[security-announce] SUSE-SU-2013:1153-1: important: Security update for
-
http://www.debian.org/security/2013/dsa-2716
Debian -- Security Information -- DSA-2716-1 iceweasel
-
http://www.debian.org/security/2013/dsa-2720
Debian -- Security Information -- DSA-2720-1 icedove
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243
Repository / Oval Repository
-
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html
[security-announce] openSUSE-SU-2013:1143-1: important: xulrunner: 17.0.
-
http://www.securityfocus.com/bid/60784
Mozilla Firefox/Thunderbird CVE-2013-1697 Security Bypass Vulnerability
-
http://www.ubuntu.com/usn/USN-1890-1
USN-1890-1: Firefox vulnerabilities | Ubuntu security notices
-
http://www.mozilla.org/security/announce/2013/mfsa2013-59.html
XrayWrappers can be bypassed to run user defined methods in a privileged context — MozillaVendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=858101
858101 - (CVE-2013-1697) [[DefaultValue]] on XrayWrapper can call content-defined toString/valueOf methods
-
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html
[security-announce] SUSE-SU-2013:1152-1: important: Security update for
-
http://rhn.redhat.com/errata/RHSA-2013-0982.html
RHSA-2013:0982 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2013-0981.html
RHSA-2013:0981 - Security Advisory - Red Hat Customer Portal
-
http://www.ubuntu.com/usn/USN-1891-1
USN-1891-1: Thunderbird vulnerabilities | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html
[security-announce] openSUSE-SU-2013:1141-1: important: MozillaThunderbi
Products affected by CVE-2013-1697
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:17.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:17.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:17.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:17.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:17.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:17.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:17.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird_esr:17.0.6:*:*:*:*:*:*:*