CVE-2013-0747: Input Validation
The gPluginHandler.handleEvent function in the plugin handler in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly enforce the Same Origin Policy, which allows remote attackers to conduct clickjacking attacks via crafted JavaScript code that listens for a mutation event.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0747?
CVE-2013-0747 is classified as a high severity vulnerability due to its potential impact on the Same Origin Policy enforcement.
How do I fix CVE-2013-0747?
To fix CVE-2013-0747, users should update to the latest version of Mozilla Firefox, Firefox ESR, Thunderbird, Thunderbird ESR, or SeaMonkey.
Which software is affected by CVE-2013-0747?
CVE-2013-0747 affects Mozilla Firefox versions prior to 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, and other related software.
Is CVE-2013-0747 exploitable by remote attackers?
Yes, CVE-2013-0747 allows remote attackers to exploit the vulnerability to bypass the Same Origin Policy.
Can outdated versions of openSUSE be affected by CVE-2013-0747?
Yes, versions of openSUSE prior to 11.4 and certain SUSE Linux distributions may be at risk from CVE-2013-0747.