What’s Vulnerable › Vulnerabilities

CVE-2013-1675: Mozilla Firefox Information Disclosure Vulnerability

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-03
• EPSS: 6.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2013-05-16 · updated 2026-06-16
• Weakness: CWE-665

Description

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Affected products

• Canonical Ubuntu Linux: 12.04, 12.10, 13.04
• Debian Linux: 7.0
• Mozilla Firefox: before 21.0; from 17.0 before 17.0.6 — fixed in 17.0.6, 21.0
• Mozilla Thunderbird: before 17.0.6 — fixed in 17.0.6
• Mozilla Thunderbird ESR: from 17.0 before 17.0.6 — fixed in 17.0.6
• Opensuse: 12.2, 12.3
• RedHat Enterprise Linux Desktop: 5.0, 6.0
• RedHat Enterprise Linux Eus: 5.9, 6.4
• RedHat Enterprise Linux For Ibm Z Systems: 5.0_s390x, 6.0_s390x
• RedHat Enterprise Linux For Ibm Z Systems Eus: 5.9_s390x, 6.4_s390x
• RedHat Enterprise Linux For Power Big Endian: 5.0_ppc, 6.0_ppc64
• RedHat Enterprise Linux For Power Big Endian Eus: 5.9_ppc, 6.4_ppc64
• RedHat Enterprise Linux For Scientific Computing: 6.0
• RedHat Enterprise Linux Server: 5.0, 6.0
• RedHat Enterprise Linux Server Aus: 5.9, 6.4
• RedHat Enterprise Linux Server Eus From Rhui: 5.9, 6.4
• RedHat Enterprise Linux Workstation: 5.0, 6.0
• RedHat Gluster Storage Server For On-Premise: 2.1

How to fix

Upgrade to a fixed version: Mozilla Firefox 17.0.6, 21.0; Mozilla Thunderbird 17.0.6; Mozilla Thunderbird ESR 17.0.6. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html
• http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html
• http://rhn.redhat.com/errata/RHSA-2013-0820.html
• http://rhn.redhat.com/errata/RHSA-2013-0821.html
• http://www.debian.org/security/2013/dsa-2699
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:165
• http://www.mozilla.org/security/announce/2013/mfsa2013-47.html
• http://www.securityfocus.com/bid/59858
• http://www.ubuntu.com/usn/USN-1822-1

Get alerted when CVE-2013-1675 or the next vulnerability affects your stack