CVE-2013-1710
NoneCVSS
—
EPSS
40.1%
Published
Aug 7, 2013
CISA due date
—
The record
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:7 | icedove | 0 | 17.0.8-1~deb7u1 |
| Debian:7 | iceweasel | 0 | 17.0.8esr-1~deb7u1 |
| Mageia:2 | firefox | 0 | 17.0.8-1.mga2 |
| Mageia:2 | firefox-l10n | 0 | 17.0.8-1.mga2 |
| Mageia:2 | iceape | 0 | 2.22-1.mga2 |
| Mageia:2 | thunderbird | 0 | 17.0.8-1.mga2 |
| Mageia:2 | thunderbird-l10n | 0 | 17.0.8-1.mga2 |
| Mageia:3 | firefox | 0 | 17.0.8-1.mga3 |
| Mageia:3 | firefox-l10n | 0 | 17.0.8-1.mga3 |
| Mageia:3 | iceape | 0 | 2.22-1.mga3 |
| Mageia:3 | thunderbird | 0 | 17.0.8-1.mga3 |
| Mageia:3 | thunderbird-l10n | 0 | 17.0.8-1.mga3 |
| Red Hat:enterprise_linux:5::server | firefox | 0 | 0:17.0.8-1.el5_9 |
| Red Hat:enterprise_linux:5::server | firefox-debuginfo | 0 | 0:17.0.8-1.el5_9 |
| Red Hat:enterprise_linux:5::server | xulrunner | 0 | 0:17.0.8-3.el5_9 |
| Red Hat:enterprise_linux:5::server | xulrunner-debuginfo | 0 | 0:17.0.8-3.el5_9 |
| Red Hat:enterprise_linux:5::server | xulrunner-devel | 0 | 0:17.0.8-3.el5_9 |
| Red Hat:enterprise_linux:6::client | firefox | 0 | 0:17.0.8-1.el6_4 |
| Red Hat:enterprise_linux:6::client | firefox-debuginfo | 0 | 0:17.0.8-1.el6_4 |
| Red Hat:enterprise_linux:6::client | thunderbird | 0 | 0:17.0.8-5.el6_4 |
| Red Hat:enterprise_linux:6::client | thunderbird-debuginfo | 0 | 0:17.0.8-5.el6_4 |
| Red Hat:enterprise_linux:6::client | xulrunner | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::client | xulrunner-debuginfo | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::client | xulrunner-devel | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::computenode | firefox | 0 | 0:17.0.8-1.el6_4 |
| Red Hat:enterprise_linux:6::computenode | firefox-debuginfo | 0 | 0:17.0.8-1.el6_4 |
| Red Hat:enterprise_linux:6::computenode | xulrunner | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::computenode | xulrunner-debuginfo | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::computenode | xulrunner-devel | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::server | firefox | 0 | 0:17.0.8-1.el6_4 |
| Red Hat:enterprise_linux:6::server | firefox-debuginfo | 0 | 0:17.0.8-1.el6_4 |
| Red Hat:enterprise_linux:6::server | thunderbird | 0 | 0:17.0.8-5.el6_4 |
| Red Hat:enterprise_linux:6::server | thunderbird-debuginfo | 0 | 0:17.0.8-5.el6_4 |
| Red Hat:enterprise_linux:6::server | xulrunner | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::server | xulrunner-debuginfo | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::server | xulrunner-devel | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::workstation | firefox | 0 | 0:17.0.8-1.el6_4 |
| Red Hat:enterprise_linux:6::workstation | firefox-debuginfo | 0 | 0:17.0.8-1.el6_4 |
| Red Hat:enterprise_linux:6::workstation | thunderbird | 0 | 0:17.0.8-5.el6_4 |
| Red Hat:enterprise_linux:6::workstation | thunderbird-debuginfo | 0 | 0:17.0.8-5.el6_4 |
| Red Hat:enterprise_linux:6::workstation | xulrunner | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::workstation | xulrunner-debuginfo | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:enterprise_linux:6::workstation | xulrunner-devel | 0 | 0:17.0.8-3.el6_4 |
| Red Hat:rhel_productivity:5 | thunderbird | 0 | 0:17.0.8-5.el5_9 |
| Red Hat:rhel_productivity:5 | thunderbird-debuginfo | 0 | 0:17.0.8-5.el5_9 |
| openSUSE:Tumbleweed | MozillaFirefox | 0 | 50.1.0-1.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 45.5.1-1.1 |
| openSUSE:Tumbleweed | firefox-esr | 0 | 128.5.1-1.1 |
Related vulnerabilities
- CVE-2017-7753 An out-of-bounds read occurs when applying style rules to pseudo-elements, such as… Also affects icedove
- CVE-2017-5470 Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Also affects icedove
- CVE-2017-5404 A use-after-free error can occur when manipulating ranges in selections with one node… Also affects icedove
- CVE-2017-5398 Memory safety bugs were reported in Thunderbird 45.7. Also affects icedove
- CVE-2016-9899 Use-after-free while manipulating DOM events and removing audio elements due to errors in… Also affects icedove
- CVE-2017-5375 JIT code allocation can allow for a bypass of ASLR and DEP protections leading to… Also affects icedove
- CVE-2017-5373 Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Also affects icedove
- CVE-2016-9893 Memory safety bugs were reported in Thunderbird 45.5. Also affects icedove