CVE-2013-1675

mozilla firefox, mozilla thunderbird, mozilla thunderbird esr

Published 16 May 2013 · updated 16 Jun 2026 · Analyzed

6.5 Medium · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 3 Mar 2022, with a remediation deadline of 24 Mar 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

References

lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html · Mailing List, Third Party Advisory
rhn.redhat.com/errata/RHSA-2013-0820.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2013-0821.html · Third Party Advisory
www.debian.org/security/2013/dsa-2699 · Mailing List
www.mandriva.com/security/advisories?name=MDVSA-2013:165 · Broken Link
www.mozilla.org/security/announce/2013/mfsa2013-47.html · Vendor Advisory
www.securityfocus.com/bid/59858 · Broken Link, Third Party Advisory, VDB Entry
www.ubuntu.com/usn/USN-1822-1 · Third Party Advisory
www.ubuntu.com/usn/USN-1823-1 · Third Party Advisory
bugzilla.mozilla.org/show_bug.cgi?id=866825 · Exploit, Issue Tracking
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976 · Broken Link
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1675 · US Government Resource