CVE-2013-1697
First published: Wed Jun 26 2013(Updated: )
The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
Credit: security@mozilla.org security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox | <=21.0 | |
| Mozilla Firefox | =19.0 | |
| Mozilla Firefox | =19.0.1 | |
| Mozilla Firefox | =19.0.2 | |
| Mozilla Firefox | =20.0 | |
| Mozilla Firefox | =20.0.1 | |
| Mozilla Firefox | =17.0 | |
| Mozilla Firefox | =17.0.1 | |
| Mozilla Firefox | =17.0.2 | |
| Mozilla Firefox | =17.0.3 | |
| Mozilla Firefox | =17.0.4 | |
| Mozilla Firefox | =17.0.5 | |
| Mozilla Firefox | =17.0.6 | |
| Mozilla Thunderbird | <=17.0.6 | |
| Mozilla Thunderbird | =17.0 | |
| Mozilla Thunderbird | =17.0.1 | |
| Mozilla Thunderbird | =17.0.2 | |
| Mozilla Thunderbird | =17.0.3 | |
| Mozilla Thunderbird | =17.0.4 | |
| Mozilla Thunderbird | =17.0.5 | |
| Mozilla Thunderbird ESR | =17.0 | |
| Mozilla Thunderbird ESR | =17.0.1 | |
| Mozilla Thunderbird ESR | =17.0.2 | |
| Mozilla Thunderbird ESR | =17.0.3 | |
| Mozilla Thunderbird ESR | =17.0.4 | |
| Mozilla Thunderbird ESR | =17.0.5 | |
| Mozilla Thunderbird ESR | =17.0.6 | |
| Mozilla Firefox ESR | =17.0 | |
| Mozilla Firefox ESR | =17.0.1 | |
| Mozilla Firefox ESR | =17.0.2 | |
| Mozilla Firefox ESR | =17.0.3 | |
| Mozilla Firefox ESR | =17.0.4 | |
| Mozilla Firefox ESR | =17.0.5 | |
| Mozilla Firefox ESR | =17.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2013-0981.html
- http://rhn.redhat.com/errata/RHSA-2013-0982.html
- http://www.debian.org/security/2013/dsa-2716
- http://www.debian.org/security/2013/dsa-2720
- http://www.mozilla.org/security/announce/2013/mfsa2013-59.html
- http://www.securityfocus.com/bid/60784
- http://www.ubuntu.com/usn/USN-1890-1
- http://www.ubuntu.com/usn/USN-1891-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=858101
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243
Frequently Asked Questions
What is the severity of CVE-2013-1697?
CVE-2013-1697 has been classified as a critical vulnerability, which allows for potential remote code execution.
Which versions are affected by CVE-2013-1697?
CVE-2013-1697 affects Mozilla Firefox versions prior to 22.0, Thunderbird prior to 17.0.7, and their respective ESR versions before 17.0.7.
How do I fix CVE-2013-1697?
To fix CVE-2013-1697, upgrade your Mozilla Firefox or Thunderbird to the latest version that is not vulnerable.
Can CVE-2013-1697 allow attackers to execute malicious code?
Yes, CVE-2013-1697 allows attackers to execute arbitrary JavaScript code, posing a significant security risk.
Is there a workaround for CVE-2013-1697?
There are no reliable workarounds for CVE-2013-1697; the best protection is to update to a patched version.
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- agent/author
- agent/last-modified-date
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- agent/source
- vendor/mozilla
- canonical/mozilla firefox
- version/mozilla firefox/21.0
- version/mozilla firefox/19.0
- version/mozilla firefox/19.0.1
- version/mozilla firefox/19.0.2
- version/mozilla firefox/20.0
- version/mozilla firefox/20.0.1
- version/mozilla firefox/17.0
- version/mozilla firefox/17.0.1
- version/mozilla firefox/17.0.2
- version/mozilla firefox/17.0.3
- version/mozilla firefox/17.0.4
- version/mozilla firefox/17.0.5
- version/mozilla firefox/17.0.6
- canonical/mozilla thunderbird
- version/mozilla thunderbird/17.0.6
- version/mozilla thunderbird/17.0
- version/mozilla thunderbird/17.0.1
- version/mozilla thunderbird/17.0.2
- version/mozilla thunderbird/17.0.3
- version/mozilla thunderbird/17.0.4
- version/mozilla thunderbird/17.0.5
- canonical/mozilla thunderbird esr
- version/mozilla thunderbird esr/17.0
- version/mozilla thunderbird esr/17.0.1
- version/mozilla thunderbird esr/17.0.2
- version/mozilla thunderbird esr/17.0.3
- version/mozilla thunderbird esr/17.0.4
- version/mozilla thunderbird esr/17.0.5
- version/mozilla thunderbird esr/17.0.6
- canonical/mozilla firefox esr
- version/mozilla firefox esr/17.0
- version/mozilla firefox esr/17.0.1
- version/mozilla firefox esr/17.0.2
- version/mozilla firefox esr/17.0.3
- version/mozilla firefox esr/17.0.4
- version/mozilla firefox esr/17.0.5
- version/mozilla firefox esr/17.0.6