9.3

CVE-2013-1687

The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version <= 21.0
Mozilla ≫ Firefox Version 19.0
Mozilla ≫ Firefox Version 19.0.1
Mozilla ≫ Firefox Version 19.0.2
Mozilla ≫ Firefox Version 20.0
Mozilla ≫ Firefox Version 20.0.1
Mozilla ≫ Firefox Version 17.0
Mozilla ≫ Firefox Version 17.0.1
Mozilla ≫ Firefox Version 17.0.2
Mozilla ≫ Firefox Version 17.0.3
Mozilla ≫ Firefox Version 17.0.4
Mozilla ≫ Firefox Version 17.0.5
Mozilla ≫ Firefox Version 17.0.6
Mozilla ≫ Thunderbird Version <= 17.0.6
Mozilla ≫ Thunderbird Version 17.0
Mozilla ≫ Thunderbird Version 17.0.1
Mozilla ≫ Thunderbird Version 17.0.2
Mozilla ≫ Thunderbird Version 17.0.3
Mozilla ≫ Thunderbird Version 17.0.4
Mozilla ≫ Thunderbird Version 17.0.5
Mozilla ≫ Thunderbird Esr Version 17.0
Mozilla ≫ Thunderbird Esr Version 17.0.1
Mozilla ≫ Thunderbird Esr Version 17.0.2
Mozilla ≫ Thunderbird Esr Version 17.0.3
Mozilla ≫ Thunderbird Esr Version 17.0.4
Mozilla ≫ Thunderbird Esr Version 17.0.5
Mozilla ≫ Thunderbird Esr Version 17.0.6
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.34% 0.871
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html
http://rhn.redhat.com/errata/RHSA-2013-0981.html
http://rhn.redhat.com/errata/RHSA-2013-0982.html
http://www.debian.org/security/2013/dsa-2716
http://www.debian.org/security/2013/dsa-2720
http://www.ubuntu.com/usn/USN-1890-1
http://www.ubuntu.com/usn/USN-1891-1
http://www.mozilla.org/security/announce/2013/mfsa2013-51.html
Vendor Advisory
http://www.securityfocus.com/bid/60777
https://bugzilla.mozilla.org/show_bug.cgi?id=863933
https://bugzilla.mozilla.org/show_bug.cgi?id=866823
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17117