Vulnerability Details : CVE-2013-5618
Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code by triggering improper garbage collection.
Vulnerability category: Memory CorruptionExecute code
Exploit prediction scoring system (EPSS) score for CVE-2013-5618
Probability of exploitation activity in the next 30 days: 2.65%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 89 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-5618
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2013-5618
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-5618
-
http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00010.html
[security-announce] SUSE-SU-2013:1919-1: important: Security update forMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html
openSUSE-SU-2013:1958-1: moderate: update for MozillaThunderbirdMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html
openSUSE-SU-2013:1918-1: moderate: update for MozillaFirefoxMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html
openSUSE-SU-2013:1959-1: moderate: update for MozillaThunderbirdMailing List;Third Party Advisory
-
http://www.ubuntu.com/usn/USN-2053-1
USN-2053-1: Thunderbird vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html
[SECURITY] Fedora 19 Update: firefox-26.0-2.fc19Mailing List;Third Party Advisory
-
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
Oracle Solaris Bulletin - April 2016Third Party Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=926361
926361 - (CVE-2013-5618) ASAN use-after-free in nsNodeUtils::LastRelease on anonymous node from ShowInlineTableEditingUIExploit;Issue Tracking;Vendor Advisory
-
https://security.gentoo.org/glsa/201504-01
Mozilla Products: Multiple vulnerabilities (GLSA 201504-01) — Gentoo securityThird Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html
openSUSE-SU-2014:0008-1: moderate: update for seamonkeyMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html
openSUSE-SU-2013:1917-1: moderate: update for MozillaFirefoxMailing List;Third Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html
[SECURITY] Fedora 20 Update: firefox-26.0-3.fc20Mailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html
openSUSE-SU-2013:1957-1: moderate: update for MozillaThunderbirdMailing List;Third Party Advisory
-
http://www.ubuntu.com/usn/USN-2052-1
USN-2052-1: Firefox vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2013-1812.html
RHSA-2013:1812 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.securitytracker.com/id/1029476
Mozilla Seamonkey Multiple Flaws Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks - SecurityTrackerThird Party Advisory;VDB Entry
-
http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html
openSUSE-SU-2013:1916-1: moderate: update for MozillaFirefoxMailing List;Third Party Advisory
-
http://www.mozilla.org/security/announce/2013/mfsa2013-109.html
Use-after-free during Table Editing — MozillaVendor Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html
[SECURITY] Fedora 18 Update: thunderbird-24.2.0-2.fc18Mailing List;Third Party Advisory
-
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html
[SECURITY] Fedora 19 Update: thunderbird-24.2.0-2.fc19Mailing List;Third Party Advisory
-
http://www.securitytracker.com/id/1029470
Mozilla Firefox Multiple Flaws Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting Attacks - SecurityTrackerThird Party Advisory;VDB Entry
Products affected by CVE-2013-5618
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_tus:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
- cpe:2.3:a:suse:suse_linux_enterprise_software_development_kit:11.0:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp3:*:*:*:-:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:18:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*