CVE-2013-1670: XSS
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1670?
CVE-2013-1670 has a medium severity rating, allowing attackers to gain unauthorized chrome privileges.
How do I fix CVE-2013-1670?
To fix CVE-2013-1670, update affected Mozilla Firefox and Thunderbird versions to at least 21.0 or the suitable ESR versions.
Which versions are affected by CVE-2013-1670?
CVE-2013-1670 affects Mozilla Firefox versions prior to 21.0, Thunderbird versions prior to 17.0.6, and their respective ESR versions.
Is there a workaround for CVE-2013-1670?
No official workaround is recommended for CVE-2013-1670 other than updating to the latest software version.
Who can exploit CVE-2013-1670?
CVE-2013-1670 can be exploited remotely by attackers to gain elevated privileges in vulnerable applications.