Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-1680

Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

Published

2013-05-16T11:45:30.990

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mozilla firefox ≤ 20.0.1 Yes
Application mozilla firefox 19.0 Yes
Application mozilla firefox 19.0.1 Yes
Application mozilla firefox 19.0.2 Yes
Application mozilla firefox 20.0 Yes
Application mozilla firefox 17.0 Yes
Application mozilla firefox 17.0.1 Yes
Application mozilla firefox 17.0.2 Yes
Application mozilla firefox 17.0.3 Yes
Application mozilla firefox 17.0.4 Yes
Application mozilla firefox 17.0.5 Yes
Application mozilla thunderbird ≤ 17.0.5 Yes
Application mozilla thunderbird 17.0 Yes
Application mozilla thunderbird 17.0.1 Yes
Application mozilla thunderbird 17.0.2 Yes
Application mozilla thunderbird 17.0.3 Yes
Application mozilla thunderbird 17.0.4 Yes
Application mozilla thunderbird_esr 17.0 Yes
Application mozilla thunderbird_esr 17.0.1 Yes
Application mozilla thunderbird_esr 17.0.2 Yes
Application mozilla thunderbird_esr 17.0.3 Yes
Application mozilla thunderbird_esr 17.0.4 Yes
Application mozilla thunderbird_esr 17.0.5 Yes
References