What’s Vulnerable › Vulnerabilities

CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-28
• EPSS: 69.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2013-06-26 · updated 2026-06-16
• Weakness: CWE-119

Description

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

Affected products

• Canonical Ubuntu Linux: 12.04, 12.10, 13.04
• Debian Linux: 7.0
• Mozilla Firefox: before 22.0; from 17.0 before 17.0.7 — fixed in 17.0.7, 22.0
• Mozilla Thunderbird: before 17.0.7 — fixed in 17.0.7
• Mozilla Thunderbird ESR: from 17.0 before 17.0.7 — fixed in 17.0.7
• Opensuse: 11.4, 12.2, 12.3
• RedHat Enterprise Linux Desktop: 5.0, 6.0
• RedHat Enterprise Linux Eus: 5.9, 6.4
• RedHat Enterprise Linux Server: 5.0, 6.0
• RedHat Enterprise Linux Server Aus: 5.9, 6.4
• RedHat Enterprise Linux Workstation: 5.0, 6.0
• RedHat Gluster Storage Server For On-Premise: 2.0
• SUSE Linux Enterprise Server 15 SP1: 10-sp4, 11-sp2, 11-sp3
• SUSE Linux Enterprise Server: 10-sp4, 11-sp1, 11-sp2, 11-sp3
• SUSE Linux Enterprise Software Development Kit: 10-sp4, 11-sp3

How to fix

Upgrade to a fixed version: Mozilla Firefox 17.0.7, 22.0; Mozilla Thunderbird 17.0.7; Mozilla Thunderbird ESR 17.0.7. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html
• http://rhn.redhat.com/errata/RHSA-2013-0981.html
• http://rhn.redhat.com/errata/RHSA-2013-0982.html
• http://www.debian.org/security/2013/dsa-2716
• http://www.debian.org/security/2013/dsa-2720
• http://www.mozilla.org/security/announce/2013/mfsa2013-53.html
• http://www.securityfocus.com/bid/60778

Get alerted when CVE-2013-1690 or the next vulnerability affects your stack