What’s Vulnerable › Vulnerabilities

CVE-2013-1730

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-09-18 · updated 2026-06-16
• Weakness: CWE-119

Description

Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly handle movement of XBL-backed nodes between documents, which allows remote attackers to execute arbitrary code or cause a denial of service (JavaScript compartment mismatch, or assertion failure and application exit) via a crafted web site.

Affected products

• Mozilla Firefox: through 23.0.1; 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4, 17.0.5 (+11)
• Mozilla Seamonkey: through 2.20; 2.0, 2.0-alpha_1, 2.0-alpha_2, 2.0-alpha_3, 2.0-beta_1, 2.0-beta_2 (+93)
• Mozilla Thunderbird: through 17.0.9; 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4, 17.0.5 (+3)
• Mozilla Thunderbird ESR: 17.0, 17.0.1, 17.0.2, 17.0.3, 17.0.4, 17.0.5 (+3)

References

• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/115907.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116610.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/117526.html
• http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html
• http://lists.opensuse.org/opensuse-updates/2013-09/msg00055.html
• http://lists.opensuse.org/opensuse-updates/2013-09/msg00057.html
• http://lists.opensuse.org/opensuse-updates/2013-09/msg00059.html
• http://lists.opensuse.org/opensuse-updates/2013-09/msg00060.html
• http://lists.opensuse.org/opensuse-updates/2013-09/msg00061.html
• http://rhn.redhat.com/errata/RHSA-2013-1268.html
• http://rhn.redhat.com/errata/RHSA-2013-1269.html
• http://www.debian.org/security/2013/dsa-2762

Get alerted when CVE-2013-1730 or the next vulnerability affects your stack