{
  "id": "CVE-2013-1690",
  "url": "https://spydr.io/cve/CVE-2013-1690",
  "published": "2013-06-26T03:19:10.793Z",
  "modified": "2026-06-16T23:51:55.617Z",
  "score": 8.8,
  "severity": "high",
  "cvss_version": "3.1",
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "score_source": "NVD",
  "epss": 0.69021,
  "epss_percentile": 0.99338,
  "exploited": true,
  "kev": {
    "added": "2022-03-28",
    "due": "2022-04-18",
    "action": "Apply updates per vendor instructions.",
    "ransomware": "Unknown",
    "name": "Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability",
    "notes": "https://nvd.nist.gov/vuln/detail/CVE-2013-1690"
  },
  "ssvc_exploitation": "active",
  "vendors": [
    "mozilla",
    "canonical",
    "debian",
    "redhat",
    "opensuse",
    "suse"
  ],
  "products": [
    "mozilla firefox",
    "mozilla thunderbird",
    "mozilla thunderbird esr",
    "canonical ubuntu linux",
    "debian linux",
    "redhat gluster storage server for on-premise",
    "redhat enterprise linux desktop",
    "redhat enterprise linux eus",
    "redhat enterprise linux server",
    "redhat enterprise linux server aus",
    "redhat enterprise linux workstation",
    "opensuse",
    "suse linux enterprise desktop",
    "suse linux enterprise server",
    "suse linux enterprise software development kit"
  ],
  "cwes": [
    "CWE-119"
  ],
  "description": "Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.",
  "status": "Analyzed",
  "score_type": "Primary",
  "scores": {
    "cvss_v40": null,
    "cvss_v31": 8.8,
    "cvss_v30": null
  },
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2716",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2720",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-53.html",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.securityfocus.com/bid/60778",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1890-1",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1891-1",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=857883",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=901365",
      "tags": [
        "Issue Tracking"
      ]
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996",
      "tags": [
        "Broken Link"
      ]
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1690",
      "tags": [
        "US Government Resource"
      ]
    }
  ],
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1690",
  "covered_in": [],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}