Cloudanix VulnDB

CVE-2013-1670

None

CVSS

—

EPSS

10.9%

Published

May 16, 2013

CISA due date

—

The record

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Affected packages

Ecosystem Package Introduced Fixed
Debian:7 icedove 0 17.0.7-1~deb7u1
Debian:7 iceweasel 0 17.0.6esr-1~deb7u1
Red Hat:enterprise_linux:5::server firefox 0 0:17.0.6-1.el5_9
Red Hat:enterprise_linux:5::server firefox-debuginfo 0 0:17.0.6-1.el5_9
Red Hat:enterprise_linux:5::server xulrunner 0 0:17.0.6-1.el5_9
Red Hat:enterprise_linux:5::server xulrunner-debuginfo 0 0:17.0.6-1.el5_9
Red Hat:enterprise_linux:5::server xulrunner-devel 0 0:17.0.6-1.el5_9
Red Hat:enterprise_linux:6::client firefox 0 0:17.0.6-1.el6_4
Red Hat:enterprise_linux:6::client firefox-debuginfo 0 0:17.0.6-1.el6_4
Red Hat:enterprise_linux:6::client thunderbird 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::client thunderbird-debuginfo 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::client xulrunner 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::client xulrunner-debuginfo 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::client xulrunner-devel 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::computenode firefox 0 0:17.0.6-1.el6_4
Red Hat:enterprise_linux:6::computenode firefox-debuginfo 0 0:17.0.6-1.el6_4
Red Hat:enterprise_linux:6::computenode xulrunner 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::computenode xulrunner-debuginfo 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::computenode xulrunner-devel 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::server firefox 0 0:17.0.6-1.el6_4
Red Hat:enterprise_linux:6::server firefox-debuginfo 0 0:17.0.6-1.el6_4
Red Hat:enterprise_linux:6::server thunderbird 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::server thunderbird-debuginfo 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::server xulrunner 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::server xulrunner-debuginfo 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::server xulrunner-devel 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::workstation firefox 0 0:17.0.6-1.el6_4
Red Hat:enterprise_linux:6::workstation firefox-debuginfo 0 0:17.0.6-1.el6_4
Red Hat:enterprise_linux:6::workstation thunderbird 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::workstation thunderbird-debuginfo 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::workstation xulrunner 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::workstation xulrunner-debuginfo 0 0:17.0.6-2.el6_4
Red Hat:enterprise_linux:6::workstation xulrunner-devel 0 0:17.0.6-2.el6_4
Red Hat:rhel_productivity:5 thunderbird 0 0:17.0.6-1.el5_9
Red Hat:rhel_productivity:5 thunderbird-debuginfo 0 0:17.0.6-1.el5_9
openSUSE:Tumbleweed MozillaFirefox 0 50.1.0-1.1
openSUSE:Tumbleweed MozillaThunderbird 0 45.5.1-1.1
openSUSE:Tumbleweed firefox-esr 0 128.5.1-1.1

Related vulnerabilities