CVE-2013-1697: Critical severity firefox vulnerability
The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1697?
CVE-2013-1697 has been classified as a critical vulnerability, which allows for potential remote code execution.
Which versions are affected by CVE-2013-1697?
CVE-2013-1697 affects Mozilla Firefox versions prior to 22.0, Thunderbird prior to 17.0.7, and their respective ESR versions before 17.0.7.
How do I fix CVE-2013-1697?
To fix CVE-2013-1697, upgrade your Mozilla Firefox or Thunderbird to the latest version that is not vulnerable.
Can CVE-2013-1697 allow attackers to execute malicious code?
Yes, CVE-2013-1697 allows attackers to execute arbitrary JavaScript code, posing a significant security risk.
Is there a workaround for CVE-2013-1697?
There are no reliable workarounds for CVE-2013-1697; the best protection is to update to a patched version.