Mozilla: Compartment mismatch re-attaching XBL-backed nodes (MFSA 2013-88)
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | n/a | affected |
|
Configuration 1 [-]
|
Configuration 2 [-]
|
Configuration 3 [-]
|
Configuration 4 [-]
|
Configuration 5 [-]
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Enterprise Linux 5 | |||
| thunderbird-0:17.0.9-1.el5_9 | cpe:/a:redhat:rhel_productivity:5 | RHSA-2013:1269 | 2013-09-17T00:00:00Z |
| firefox-0:17.0.9-1.el5_9 | cpe:/o:redhat:enterprise_linux:5 | RHSA-2013:1268 | 2013-09-17T00:00:00Z |
| xulrunner-0:17.0.9-1.el5_9 | cpe:/o:redhat:enterprise_linux:5 | RHSA-2013:1268 | 2013-09-17T00:00:00Z |
| Red Hat Enterprise Linux 6 | |||
| firefox-0:17.0.9-1.el6_4 | cpe:/o:redhat:enterprise_linux:6 | RHSA-2013:1268 | 2013-09-17T00:00:00Z |
| xulrunner-0:17.0.9-1.el6_4 | cpe:/o:redhat:enterprise_linux:6 | RHSA-2013:1268 | 2013-09-17T00:00:00Z |
| thunderbird-0:17.0.9-1.el6_4 | cpe:/o:redhat:enterprise_linux:6 | RHSA-2013:1269 | 2013-09-17T00:00:00Z |
No data available yet.
| Source | ID | Title |
|---|---|---|
Debian DSA |
DSA-2759-1 | iceweasel security update |
Debian DSA |
DSA-2762-1 | icedove security update |
EUVD |
EUVD-2013-1757 | Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly handle movement of XBL-backed nodes between documents, which allows remote attackers to execute arbitrary code or cause a denial of service (JavaScript compartment mismatch, or assertion failure and application exit) via a crafted web site. |
Ubuntu USN |
USN-1951-1 | Firefox vulnerabilities |
Ubuntu USN |
USN-1952-1 | Thunderbird vulnerabilities |
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
This CVE is not in the KEV list.
Exploit prediction score: 2.3% (2.251% probability within 30 days)
Key SSVC decision points have not yet been added.
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:mozilla:firefox_esr:17.0:*:*:*:*:*:*:* |
cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:* |
| Vendors & Products |
Mozilla firefox Esr
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:mozilla:firefox_esr:17.0.3:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:17.0.4:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:17.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:17.0.6:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:17.0.7:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox_esr:17.0.8:*:*:*:*:*:*:* |
cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:17.0.4:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:17.0.5:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:17.0.6:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:17.0.7:*:*:*:*:*:*:* cpe:2.3:a:mozilla:firefox:17.0.8:*:*:*:*:*:*:* |