First published: Wed Jun 26 2013(Updated: )
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
Credit: security@mozilla.org security@mozilla.org
Affected Software | Affected Version | How to fix |
---|---|---|
Firefox | <=21.0 | |
Firefox | =19.0 | |
Firefox | =19.0.1 | |
Firefox | =19.0.2 | |
Firefox | =20.0 | |
Firefox | =20.0.1 | |
Firefox ESR | =17.0 | |
Firefox ESR | =17.0.1 | |
Firefox ESR | =17.0.2 | |
Firefox ESR | =17.0.3 | |
Firefox ESR | =17.0.4 | |
Firefox ESR | =17.0.5 | |
Firefox ESR | =17.0.6 | |
Thunderbird | <=17.0.6 | |
Thunderbird | =17.0 | |
Thunderbird | =17.0.1 | |
Thunderbird | =17.0.2 | |
Thunderbird | =17.0.3 | |
Thunderbird | =17.0.4 | |
Thunderbird | =17.0.5 | |
Mozilla Thunderbird | =17.0 | |
Mozilla Thunderbird | =17.0.1 | |
Mozilla Thunderbird | =17.0.2 | |
Mozilla Thunderbird | =17.0.3 | |
Mozilla Thunderbird | =17.0.4 | |
Mozilla Thunderbird | =17.0.5 | |
Mozilla Thunderbird | =17.0.6 | |
Mozilla Thunderbird | ||
Firefox | <22.0 | |
Firefox | >=17.0<17.0.7 | |
Thunderbird | <17.0.7 | |
Mozilla Thunderbird | >=17.0<17.0.7 | |
Ubuntu | =12.04 | |
Ubuntu | =12.10 | |
Ubuntu | =13.04 | |
Debian Linux | =7.0 | |
Red Hat Gluster Storage Server | =2.0 | |
Red Hat Enterprise Linux Desktop | =5.0 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Server EUS | =5.9 | |
Red Hat Enterprise Linux Server EUS | =6.4 | |
Red Hat Enterprise Linux Server | =5.0 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =5.9 | |
Red Hat Enterprise Linux Server | =6.4 | |
Red Hat Enterprise Linux Workstation | =5.0 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
openSUSE | =11.4 | |
openSUSE | =12.2 | |
openSUSE | =12.3 | |
SUSE Linux Enterprise Desktop | =10-sp4 | |
SUSE Linux Enterprise Desktop | =11-sp2 | |
SUSE Linux Enterprise Desktop | =11-sp3 | |
SUSE Linux Enterprise Server | =10-sp4 | |
SUSE Linux Enterprise Server | =11-sp1 | |
SUSE Linux Enterprise Server | =11-sp1 | |
SUSE Linux Enterprise Server | =11-sp2 | |
SUSE Linux Enterprise Server | =11-sp2 | |
SUSE Linux Enterprise Server | =11-sp3 | |
SUSE Linux Enterprise Server | =11-sp3 | |
SUSE Linux Enterprise Software Development Kit | =10-sp4 | |
SUSE Linux Enterprise Software Development Kit | =11-sp3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2013-1690 has been classified as a moderate severity vulnerability.
To fix CVE-2013-1690, upgrade to Mozilla Firefox version 22.0 or later, or Thunderbird version 17.0.7 or later.
CVE-2013-1690 affects Mozilla Firefox versions prior to 22.0 and Thunderbird versions prior to 17.0.7.
CVE-2013-1690 allows remote attackers to cause a denial of service through improper handling of onreadystatechange events.
There is no specific workaround for CVE-2013-1690; upgrading to the fixed versions is the recommended action.