CVE-2013-1720: Buffer Overflow
The nsHtml5TreeBuilder::resetTheInsertionMode function in the HTML5 Tree Builder in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 does not properly maintain the state of the insertion-mode stack for template elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer over-read) by triggering use of this stack in its empty state.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1720?
CVE-2013-1720 has a moderate severity rating, as it could allow remote attackers to execute arbitrary code.
How do I fix CVE-2013-1720?
To fix CVE-2013-1720, update Mozilla Firefox to version 24.0 or later, Thunderbird to version 24.0 or later, or SeaMonkey to version 2.21 or later.
Which versions are affected by CVE-2013-1720?
CVE-2013-1720 affects Mozilla Firefox versions before 24.0, Thunderbird versions before 24.0, and SeaMonkey versions before 2.21.
What types of attacks can exploit CVE-2013-1720?
CVE-2013-1720 can be exploited by remote attackers to potentially execute arbitrary code, leading to further system compromise.
Is CVE-2013-1720 a local or remote vulnerability?
CVE-2013-1720 is a remote vulnerability, allowing attackers to exploit it without physical access to the affected system.