What’s Vulnerable › Vulnerabilities

CVE-2013-1670

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2013-05-16 · updated 2026-06-16
• Weakness: CWE-79

Description

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.

Affected products

• Mozilla Firefox: through 20.0.1; 19.0, 19.0.1, 19.0.2, 20.0, 17.0, 17.0.1 (+4)
• Mozilla Thunderbird: through 17.0.5; 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4
• Mozilla Thunderbird ESR: 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4, 17.0.5

References

• http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html
• http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html
• http://rhn.redhat.com/errata/RHSA-2013-0820.html
• http://rhn.redhat.com/errata/RHSA-2013-0821.html
• http://www.debian.org/security/2013/dsa-2699
• http://www.exploit-db.com/exploits/34363
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:165
• http://www.mozilla.org/security/announce/2013/mfsa2013-42.html
• http://www.osvdb.org/93427

Get alerted when CVE-2013-1670 or the next vulnerability affects your stack