CVE-2013-0758

HIGH severity · CVSS 9.3 · Code injection

9.3CVSS HIGH

Summary

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.

Impact & exploitability

Attack vectorNetwork

Attack complexity—

Privileges required—

User interaction—

Confidentiality impact—

Integrity impact—

Availability impact—

Exploit probability (EPSS)87%

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products we track (3)

Ubuntu Mozilla Firefox SUSE Linux Enterprise

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://www.mozilla.org/security/announce/2013/mfsa2013-15.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlAdvisory
http://rhn.redhat.com/errata/RHSA-2013-0144.htmlAdvisory
http://rhn.redhat.com/errata/RHSA-2013-0145.htmlAdvisory
http://www.ubuntu.com/usn/USN-1681-1Advisory