CVE-2013-1675
MediumActively exploited (CISA KEV)
Description
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Mozilla Firefox
PublishedMay 16, 2013
First seenMay 16, 2013
Added to KEVMar 3, 2022
Weakness typeCWE-665CWE-665
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Mar 24, 2022Update
- mozilla firefox21.0, 17.0.6 or later
- mozilla thunderbird17.0.6 or later
- mozilla thunderbird_esr17.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla firefox | v < 21.0, 17.0 ≤ v < 17.0.6 | 21.0, 17.0.6 |
| mozilla thunderbird | v < 17.0.6 | 17.0.6 |
| mozilla thunderbird_esr | 17.0 ≤ v < 17.0.6 | 17.0.6 |
| canonical ubuntu_linux | 12.04, 12.10, 13.04 | — |
| debian debian_linux | 7.0 | — |
| redhat gluster_storage_server_for_on-premise | 2.1 | — |
| redhat enterprise_linux_desktop | 5.0, 6.0 | — |
| redhat enterprise_linux_eus | 5.9, 6.4 | — |
| redhat enterprise_linux_for_ibm_z_systems | 5.0_s390x, 6.0_s390x | — |
| redhat enterprise_linux_for_ibm_z_systems_eus | 5.9_s390x, 6.4_s390x | — |
| redhat enterprise_linux_for_power_big_endian | 5.0_ppc, 6.0_ppc64 | — |
| redhat enterprise_linux_for_power_big_endian_eus | 5.9_ppc, 6.4_ppc64 | — |
| redhat enterprise_linux_for_scientific_computing | 6.0 | — |
| redhat enterprise_linux_server | 5.0, 6.0 | — |
| redhat enterprise_linux_server_aus | 5.9, 6.4 | — |
| redhat enterprise_linux_server_eus_from_rhui | 5.9, 6.4 | — |
| redhat enterprise_linux_workstation | 5.0, 6.0 | — |
| opensuse opensuse | 12.2, 12.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.