Mozilla · Firefox and Thunderbird
CVE-2013-1690
Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
What it is
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
CISA: Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 18, 2022
- Added to the CISA list
- March 28, 2022
- Published
- June 26, 2013
- Severity
- High 8.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 69% in the top 0.7% of all known vulnerabilities
- Weakness
- CWE-119
- More details
- NVD · CVE.org · CISA
All references (17)
- http://www.ubuntu.com/usn/USN-1890-1
- http://rhn.redhat.com/errata/RHSA-2013-0982.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html
- http://rhn.redhat.com/errata/RHSA-2013-0981.html
- http://www.ubuntu.com/usn/USN-1891-1
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html
- http://www.debian.org/security/2013/dsa-2716
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
- http://www.debian.org/security/2013/dsa-2720
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=857883
- http://www.mozilla.org/security/announce/2013/mfsa2013-53.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996
- https://bugzilla.mozilla.org/show_bug.cgi?id=901365
- http://www.securityfocus.com/bid/60778
More exploited flaws from Mozilla
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 23, 2022 | Type Confusion | Firefox and Thunderbird | High 8.8 | 38% |
| May 23, 2022 | Sandbox Escape | Firefox and Thunderbird | Critical 10.0 | 56% |
| Nov 3, 2021 | Use-After-Free | Firefox and Thunderbird | High 8.1 | 3.0% |
| Nov 3, 2021 | Use-After-Free | Firefox and Thunderbird | High 8.1 | 7.1% |
| Nov 3, 2021 | Type Confusion | Firefox and Thunderbird | High 8.8 | 46% |
| Oct 6, 2025 | Remote Code Execution | Multiple Products | Critical 9.8 | 83% |
| Oct 15, 2024 | Use-After-Free | Firefox | Critical 9.8 | 23% |
| Jun 22, 2023 | Use-After-Free | Firefox, Firefox ESR, and Thunderbird | High 7.5 | 87% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.