CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
Other sources
Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1690?
CVE-2013-1690 has been classified as a moderate severity vulnerability.
How do I fix CVE-2013-1690?
To fix CVE-2013-1690, upgrade to Mozilla Firefox version 22.0 or later, or Thunderbird version 17.0.7 or later.
What systems are affected by CVE-2013-1690?
CVE-2013-1690 affects Mozilla Firefox versions prior to 22.0 and Thunderbird versions prior to 17.0.7.
What type of attack does CVE-2013-1690 facilitate?
CVE-2013-1690 allows remote attackers to cause a denial of service through improper handling of onreadystatechange events.
Is there a workaround for CVE-2013-1690?
There is no specific workaround for CVE-2013-1690; upgrading to the fixed versions is the recommended action.