CVEvulnerability
CVE-2013-1675
CISA Known Exploited Vulnerability
Mozilla Firefox Information Disclosure Vulnerability — Mozilla Firefox
Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
- Added to KEV
- 2022-03-03
- Remediation due
- 2022-03-24
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2013-1675
- Status
- Analyzed
- Published
- 2013-05-16
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-665
Description
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
Affected configurations
• mozilla firefox (< 21.0)
• mozilla firefox (>= 17.0 < 17.0.6)
• mozilla thunderbird (< 17.0.6)
• mozilla thunderbird esr (>= 17.0 < 17.0.6)
• canonical ubuntu linux 12.04
• canonical ubuntu linux 12.10
• canonical ubuntu linux 13.04
• debian debian linux 7.0
• redhat gluster storage server for on-premise 2.1
• redhat enterprise linux desktop 5.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux eus 5.9
• redhat enterprise linux eus 6.4
• redhat enterprise linux for ibm z systems 5.0 s390x
• redhat enterprise linux for ibm z systems 6.0 s390x
• redhat enterprise linux for ibm z systems eus 5.9 s390x
• redhat enterprise linux for ibm z systems eus 6.4 s390x
• redhat enterprise linux for power big endian 5.0 ppc
• redhat enterprise linux for power big endian 6.0 ppc64
• redhat enterprise linux for power big endian eus 5.9 ppc
• redhat enterprise linux for power big endian eus 6.4 ppc64
• redhat enterprise linux for scientific computing 6.0
• redhat enterprise linux server 5.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server aus 5.9
• redhat enterprise linux server aus 6.4
• redhat enterprise linux server eus from rhui 5.9
• redhat enterprise linux server eus from rhui 6.4
• redhat enterprise linux workstation 5.0
• redhat enterprise linux workstation 6.0
• opensuse opensuse 12.2
• opensuse opensuse 12.3
Related
Weakness · CWE (1)
- CWE-665 Improper Initialization weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0820.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0821.html Third Party Advisory
- http://www.debian.org/security/2013/dsa-2699 Mailing List
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:165 Broken Link
- http://www.mozilla.org/security/announce/2013/mfsa2013-47.html Vendor Advisory
- http://www.securityfocus.com/bid/59858 Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1822-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-1823-1 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=866825 Exploit, Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976 Broken Link
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0820.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0821.html Third Party Advisory
- http://www.debian.org/security/2013/dsa-2699 Mailing List
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:165 Broken Link
- http://www.mozilla.org/security/announce/2013/mfsa2013-47.html Vendor Advisory
- http://www.securityfocus.com/bid/59858 Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-1822-1 Third Party Advisory
- http://www.ubuntu.com/usn/USN-1823-1 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=866825 Exploit, Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976 Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1675 US Government Resource