CVE-2013-1690 Mozilla Firefox and Thunderbird Denial-of-Service
Remote attackers can cause application crashes or execute arbitrary code via crafted websites due to improper handling of onreadystatechange events.
- Exploited in the wild
- Since 28 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2013-1690?
CVE-2013-1690 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 26 Jun 2013. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
Weakness: CWE-119
Which versions are affected by CVE-2013-1690?
It affects 15 products.
Products include Canonical Ubuntu Linux, Debian Debian Linux, Mozilla Firefox, Mozilla Thunderbird, Mozilla Thunderbird Esr, Opensuse Opensuse and 9 more.
How do I fix CVE-2013-1690?
Upgrade to a fixed version. US federal agencies must fix it by 18 Apr 2022.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2013-1690 being exploited?
Yes. Attackers have exploited CVE-2013-1690 in the wild since at least 28 Mar 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as GHSA-m5w3-m6g8-4mhf.