CVE-2013-1697

{"id": "CVE-2013-1697", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-06-26T03:19:10.903", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html", "source": "[email protected]"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html", "source": "[email protected]"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html", "source": "[email protected]"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html", "source": "[email protected]"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html", "source": "[email protected]"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html", "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html", "source": "[email protected]"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html", "source": "[email protected]"}, {"url": "http://www.debian.org/security/2013/dsa-2716", "source": "[email protected]"}, {"url": "http://www.debian.org/security/2013/dsa-2720", "source": "[email protected]"}, {"url": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.securityfocus.com/bid/60784", "source": "[email protected]"}, {"url": "http://www.ubuntu.com/usn/USN-1890-1", "source": "[email protected]"}, {"url": "http://www.ubuntu.com/usn/USN-1891-1", "source": "[email protected]"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101", "source": "[email protected]"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243", "source": "[email protected]"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.debian.org/security/2013/dsa-2716", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.debian.org/security/2013/dsa-2720", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/60784", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ubuntu.com/usn/USN-1890-1", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ubuntu.com/usn/USN-1891-1", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method."}, {"lang": "es", "value": "La implementaci\u00f3n XrayWrapper en Mozilla Firefox anterior a v22.0, Firefox ESR v17.x antes de v17.0.7, Thunderbird anterior a v17.0.7 no restringe correctamente el uso de DefaultValue para las llamadas a m\u00e9todos, lo que permite a atacantes remotos ejecutar c\u00f3digo JavaScript con privilegios de chrome a trav\u00e9s de sitios web manipulados que dispara el uso de los m\u00e9todos user-defined (1) toString o (2) valueOf"}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29071754-CC8F-42D9-82D4-140236802506", "versionEndIncluding": "21.0"}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412"}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE09D089-7F48-466B-B03A-C64152A12615"}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "653D73DA-21C0-4C3F-9269-5A6D5C5B1E34"}, {"criteria": "cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "804A0ACE-EB28-413D-93F4-E849FEA01390"}, {"criteria": "cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BA49C6F-9115-41A5-BBDE-743CB9DEDDA8"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3283FBAC-B77A-4C62-9D51-70BB35FA3D13"}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "886D8A1F-ECDD-4FE9-A4E5-2322EEC0B880"}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E10B8803-C319-4AAA-81CF-FA206A33BA55"}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2B5567C-8969-456D-B6DF-3562B99C41FE"}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5657779C-19F9-42B8-BBBD-292B898E8FD2"}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EEA3B9F4-BD8E-488B-A362-0B86BC6DA275"}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A91BD4A-76BD-40B9-9E12-22CACAAE42BF"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C8122DC-6877-4EC8-8041-B579FC5AC6CA", "versionEndIncluding": "17.0.6"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2FD78A8-0D3A-412C-8776-20C598697564"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "777D8DC5-8D43-4842-B0A7-3C933F41F6E8"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "808C66D2-4C53-4544-AD21-443D9A400B84"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FB95E8B-CF01-471F-8306-BB9FB0896904"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF7E092E-BCBE-48B4-8F6A-D3E4A0369AE1"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BB1D90B0-9E81-4828-8122-A66FB0953863"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "341D94CE-C0EB-47FA-A043-E7B0F4344BBB"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84C3EE07-F201-451A-89A1-A41B8B2165E6"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45837B42-7D29-4475-94F1-E29CD5831C7F"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7028A433-7D1B-4C6F-A0F6-1B69682F7853"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86C07513-8F98-4FA6-837D-7D735AE5EA91"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1D87C70-0EC2-49DE-A59D-CAF22760BC9D"}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61AE2EAA-55A4-4FC9-BC3F-0FEE5BB2DE99"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}