CVEvulnerability
CVE-2013-5598
8.3 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-10-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 8.3 HIGH — AV:N/AC:M/Au:N/C:C/I:P/A:P
- Weaknesses
- CWE-264
Description
PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.
Affected configurations
• mozilla firefox 24.0
• mozilla firefox 24.0.1
• mozilla firefox 24.0.2
• mozilla firefox (<= 24.0)
• mozilla firefox 19.0
• mozilla firefox 19.0.1
• mozilla firefox 19.0.2
• mozilla firefox 20.0
• mozilla firefox 20.0.1
• mozilla firefox 21.0
• mozilla firefox 22.0
• mozilla firefox 23.0
• mozilla firefox 23.0.1
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2013/mfsa2013-99.html Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=920515 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19133 oval.cisecurity.org
- https://security.gentoo.org/glsa/201504-01 security.gentoo.org
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html lists.opensuse.org
- http://www.mozilla.org/security/announce/2013/mfsa2013-99.html Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=920515 bugzilla.mozilla.org
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19133 oval.cisecurity.org
- https://security.gentoo.org/glsa/201504-01 security.gentoo.org