10
CVE-2013-6671
- EPSS 10.4%
- Veröffentlicht 11.12.2013 15:55:13
- Zuletzt bearbeitet 11.04.2025 00:51:21
- Quelle security@mozilla.org
- Teams Watchlist Login
- Unerledigt Login
The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox ESR Version >= 24.0 < 24.2
Mozilla ≫ Thunderbird Version < 24.2
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version12.10
Canonical ≫ Ubuntu Linux Version13.04
Canonical ≫ Ubuntu Linux Version13.10
Redhat ≫ Enterprise Linux Desktop Version5.0
Redhat ≫ Enterprise Linux Desktop Version6.0
Redhat ≫ Enterprise Linux Eus Version6.5
Redhat ≫ Enterprise Linux Server Version5.0
Redhat ≫ Enterprise Linux Server Version6.0
Redhat ≫ Enterprise Linux Server Aus Version6.5
Redhat ≫ Enterprise Linux Server Eus Version6.5
Redhat ≫ Enterprise Linux Server Tus Version6.5
Redhat ≫ Enterprise Linux Workstation Version5.0
Redhat ≫ Enterprise Linux Workstation Version6.0
Suse ≫ Suse Linux Enterprise Software Development Kit Version11.0 Updatesp3
Suse ≫ Suse Linux Enterprise Desktop Version11 Updatesp3
Suse ≫ Suse Linux Enterprise Server Version11 Updatesp3 SwPlatformvmware
Suse ≫ Suse Linux Enterprise Server Version11 Updatesp3 SwEdition-
Fedoraproject ≫ Fedora Version18
Fedoraproject ≫ Fedora Version19
Fedoraproject ≫ Fedora Version20
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 10.4% | 0.929 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 10 | 10 | 10 |
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.