First published: Wed Jun 26 2013(Updated: )
Use-after-free vulnerability in the mozilla::ResetDir function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
Credit: security@mozilla.org security@mozilla.org
Affected Software | Affected Version | How to fix |
---|---|---|
Firefox | <=21.0 | |
Firefox | =19.0 | |
Firefox | =19.0.1 | |
Firefox | =19.0.2 | |
Firefox | =20.0 | |
Firefox | =20.0.1 | |
Firefox | =17.0 | |
Firefox | =17.0.1 | |
Firefox | =17.0.2 | |
Firefox | =17.0.3 | |
Firefox | =17.0.4 | |
Firefox | =17.0.5 | |
Firefox | =17.0.6 | |
Thunderbird | <=17.0.6 | |
Thunderbird | =17.0 | |
Thunderbird | =17.0.1 | |
Thunderbird | =17.0.2 | |
Thunderbird | =17.0.3 | |
Thunderbird | =17.0.4 | |
Thunderbird | =17.0.5 | |
Mozilla Thunderbird | =17.0 | |
Mozilla Thunderbird | =17.0.1 | |
Mozilla Thunderbird | =17.0.2 | |
Mozilla Thunderbird | =17.0.3 | |
Mozilla Thunderbird | =17.0.4 | |
Mozilla Thunderbird | =17.0.5 | |
Mozilla Thunderbird | =17.0.6 | |
Firefox ESR | =17.0 | |
Firefox ESR | =17.0.1 | |
Firefox ESR | =17.0.2 | |
Firefox ESR | =17.0.3 | |
Firefox ESR | =17.0.4 | |
Firefox ESR | =17.0.5 | |
Firefox ESR | =17.0.6 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2013-1686 has a high severity rating due to its potential to allow remote attackers to execute arbitrary code or cause a denial of service.
To mitigate CVE-2013-1686, users should update their Mozilla Firefox or Thunderbird to the latest version that addresses this vulnerability.
CVE-2013-1686 affects Mozilla Firefox versions before 22.0, Firefox ESR versions before 17.0.7, and certain versions of Thunderbird before 17.0.7.
CVE-2013-1686 enables remote attackers to exploit a use-after-free vulnerability, which can lead to arbitrary code execution or heap memory corruption.
Currently, the best practice is to update to a patched version, as there are no effective workarounds available for CVE-2013-1686.