Mozilla · Firefox
CVE-2013-1675
Mozilla Firefox Information Disclosure Vulnerability
What it is
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
CISA: Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 24, 2022
- Added to the CISA list
- March 3, 2022
- Published
- May 16, 2013
- Severity
- Medium 6.5 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 6.7% in the top 6.1% of all known vulnerabilities
- Weakness
- CWE-119
- More details
- NVD · CVE.org · CISA
All references (15)
- http://www.debian.org/security/2013/dsa-2699
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:165
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html
- http://www.ubuntu.com/usn/USN-1823-1
- http://rhn.redhat.com/errata/RHSA-2013-0821.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2013-0820.html
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html
- http://www.ubuntu.com/usn/USN-1822-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=866825
- http://www.mozilla.org/security/announce/2013/mfsa2013-47.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976
- http://www.securityfocus.com/bid/59858
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 15, 2024 | Use-After-Free | Firefox | Critical 9.8 | 23% |
| May 25, 2022 | Security Feature Bypass | Firefox | High 8.8 | 69% |
| Mar 7, 2022 | Use-After-Free | Firefox | High 8.8 | 14% |
| Mar 7, 2022 | Use-After-Free | Firefox | Critical 9.6 | 2.4% |
| Oct 6, 2025 | Remote Code Execution | Multiple Products | Critical 9.8 | 83% |
| Jun 22, 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
| May 23, 2022 | Type Confusion | Firefox and Thunderbird | High 8.8 | 38% |
| May 23, 2022 | Sandbox Escape | Firefox and Thunderbird | Critical 10.0 | 56% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.