Lucene search

Mozilla FoundationMFSA2013-13

HistoryJan 08, 2013 - 12:00 a.m.

Memory corruption in XBL with XML bindings containing SVG — Mozilla

2013-01-0800:00:00

Mozilla Foundation

www.mozilla.org

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.025 Low

EPSS

Percentile

90.1%

JSON

Security researcher Sviatoslav Chagaev reported that when using an XBL file containing multiple XML bindings with SVG content, a memory corruption can occur. In concern with remote XUL, this can lead to an exploitable crash.

Affected configurations

Vulners

Node

mozillafirefoxRange<18

mozillafirefox_esrRange<17.0.2

mozillaseamonkeyRange<2.15

mozillathunderbirdRange<17.0.2

mozillathunderbird_esrRange<17.0.2

CPENameOperatorVersion
firefoxlt18
firefox esrlt17.0.2
seamonkeylt2.15
thunderbirdlt17.0.2
thunderbird esrlt17.0.2

Name	Operator	Version
firefox	lt	18
firefox esr	lt	17.0.2
seamonkey	lt	2.15
thunderbird	lt	17.0.2
thunderbird esr	lt	17.0.2

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0752

bugzilla.mozilla.org/show_bug.cgi?id=805024

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.025 Low

EPSS

Percentile

90.1%

JSON

Related for MFSA2013-13