Is CVE-2013-5616 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 7%.

What products does CVE-2013-5616 affect?

Tracked products affected include Ubuntu. Check the version you run to see whether it is affected.

How do I fix CVE-2013-5616?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2013-5616

Q: What is CVE-2013-5616?

CVE-2013-5616 is a critical-severity software vulnerability (Use-after-free) with a CVSS score of 9.8. Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbi

CRITICAL severity · CVSS 9.8 · Use-after-free

9.8CVSS CRITICAL

Summary

Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to mListeners event listeners.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)7%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Ubuntu

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.htmlAdvisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00010.htmlAdvisory
http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.htmlAdvisory
http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.htmlAdvisory
http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.htmlAdvisory