CVE-2013-6673: Medium severity Fedoraproject Fedora vulnerability
Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 do not recognize a user's removal of trust from an EV X.509 certificate, which makes it easier for man-in-the-middle attackers to spoof SSL servers in opportunistic circumstances via a valid certificate that is unacceptable to the user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 26.0 - Upgrade
Upgrade
Mozilla Firefox ESRto a version that resolves this vulnerability.Fixed in 24.2 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 24.2 - Upgrade
Upgrade
Mozilla SeaMonkeyto a version that resolves this vulnerability.Fixed in 2.23
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6673?
CVE-2013-6673 has a moderate severity rating as it allows man-in-the-middle attacks due to improper handling of EV X.509 certificate trust removals.
What versions of software are affected by CVE-2013-6673?
CVE-2013-6673 affects multiple versions of Mozilla Firefox, Firefox ESR, Thunderbird, SeaMonkey, and specific Fedora and SUSE releases.
How do I fix CVE-2013-6673?
To fix CVE-2013-6673, update your software to the latest versions that address this vulnerability.
What types of attacks exploit CVE-2013-6673?
CVE-2013-6673 can be exploited by attackers to conduct man-in-the-middle attacks, potentially allowing them to spoof SSL servers.
Is CVE-2013-6673 still a risk if I am using the latest versions of affected software?
No, if you are using the latest versions of the affected software that have remedied CVE-2013-6673, the risk is mitigated.