Lucene search

Mozilla FoundationMFSA2013-24

HistoryFeb 19, 2013 - 12:00 a.m.

Web content bypass of COW and SOW security wrappers — Mozilla

2013-02-1900:00:00

Mozilla Foundation

www.mozilla.org

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.01 Low

EPSS

Percentile

83.3%

JSON

Mozilla developer Bobby Holley discovered that it was possible to bypass some protections in Chrome Object Wrappers (COW) and System Only Wrappers (SOW), making their prototypes mutable by web content. This could be used leak information from chrome objects and possibly allow for arbitrary code execution.

Affected configurations

Vulners

Node

mozillafirefoxRange<19

mozillafirefox_esrRange<17.0.3

mozillaseamonkeyRange<2.16

mozillathunderbirdRange<17.0.3

mozillathunderbird_esrRange<17.0.3

CPENameOperatorVersion
firefoxlt19
firefox esrlt17.0.3
seamonkeylt2.16
thunderbirdlt17.0.3
thunderbird esrlt17.0.3

Name	Operator	Version
firefox	lt	19
firefox esr	lt	17.0.3
seamonkey	lt	2.16
thunderbird	lt	17.0.3
thunderbird esr	lt	17.0.3

References

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0773

bugzilla.mozilla.org/show_bug.cgi?id=809652

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.01 Low

EPSS

Percentile

83.3%

JSON

Related for MFSA2013-24