CVE-2013-1693
First published: Wed Jun 26 2013(Updated: )
The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly bypass the Same Origin Policy and read text from a different domain, by observing timing differences in execution of filter code.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | <=21.0 | |
| Mozilla Firefox | =19.0 | |
| Mozilla Firefox | =19.0.1 | |
| Mozilla Firefox | =19.0.2 | |
| Mozilla Firefox | =20.0 | |
| Mozilla Firefox | =20.0.1 | |
| Mozilla Firefox ESR | =17.0 | |
| Mozilla Firefox ESR | =17.0.1 | |
| Mozilla Firefox ESR | =17.0.2 | |
| Mozilla Firefox ESR | =17.0.3 | |
| Mozilla Firefox ESR | =17.0.4 | |
| Mozilla Firefox ESR | =17.0.5 | |
| Mozilla Firefox ESR | =17.0.6 | |
| Mozilla Thunderbird | <=17.0.6 | |
| Mozilla Thunderbird | =17.0 | |
| Mozilla Thunderbird | =17.0.1 | |
| Mozilla Thunderbird | =17.0.2 | |
| Mozilla Thunderbird | =17.0.3 | |
| Mozilla Thunderbird | =17.0.4 | |
| Mozilla Thunderbird | =17.0.5 | |
| Mozilla Thunderbird Esr | =17.0 | |
| Mozilla Thunderbird Esr | =17.0.1 | |
| Mozilla Thunderbird Esr | =17.0.2 | |
| Mozilla Thunderbird Esr | =17.0.3 | |
| Mozilla Thunderbird Esr | =17.0.4 | |
| Mozilla Thunderbird Esr | =17.0.5 | |
| Mozilla Thunderbird Esr | =17.0.6 | |
| Mozilla Firefox | =17.0 | |
| Mozilla Firefox | =17.0.1 | |
| Mozilla Firefox | =17.0.2 | |
| Mozilla Firefox | =17.0.3 | |
| Mozilla Firefox | =17.0.4 | |
| Mozilla Firefox | =17.0.5 | |
| Mozilla Firefox | =17.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2013-0981.html
- http://rhn.redhat.com/errata/RHSA-2013-0982.html
- http://www.debian.org/security/2013/dsa-2716
- http://www.debian.org/security/2013/dsa-2720
- http://www.mozilla.org/security/announce/2013/mfsa2013-55.html
- http://www.securityfocus.com/bid/60787
- http://www.ubuntu.com/usn/USN-1890-1
- http://www.ubuntu.com/usn/USN-1891-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=711043
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17075
- agent/references
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- agent/last-modified-date
- agent/author
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/mozilla
- canonical/mozilla firefox
- version/mozilla firefox/21.0
- version/mozilla firefox/19.0
- version/mozilla firefox/19.0.1
- version/mozilla firefox/19.0.2
- version/mozilla firefox/20.0
- version/mozilla firefox/20.0.1
- canonical/mozilla firefox esr
- version/mozilla firefox esr/17.0
- version/mozilla firefox esr/17.0.1
- version/mozilla firefox esr/17.0.2
- version/mozilla firefox esr/17.0.3
- version/mozilla firefox esr/17.0.4
- version/mozilla firefox esr/17.0.5
- version/mozilla firefox esr/17.0.6
- canonical/mozilla thunderbird
- version/mozilla thunderbird/17.0.6
- version/mozilla thunderbird/17.0
- version/mozilla thunderbird/17.0.1
- version/mozilla thunderbird/17.0.2
- version/mozilla thunderbird/17.0.3
- version/mozilla thunderbird/17.0.4
- version/mozilla thunderbird/17.0.5
- canonical/mozilla thunderbird esr
- version/mozilla thunderbird esr/17.0
- version/mozilla thunderbird esr/17.0.1
- version/mozilla thunderbird esr/17.0.2
- version/mozilla thunderbird esr/17.0.3
- version/mozilla thunderbird esr/17.0.4
- version/mozilla thunderbird esr/17.0.5
- version/mozilla thunderbird esr/17.0.6
- version/mozilla firefox/17.0
- version/mozilla firefox/17.0.1
- version/mozilla firefox/17.0.2
- version/mozilla firefox/17.0.3
- version/mozilla firefox/17.0.4
- version/mozilla firefox/17.0.5
- version/mozilla firefox/17.0.6