CVE-2013-0773 The Chrome Object Wrapper (COW) and System Only Wrapper (SOW) implementations in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17....
HighCVSS 9.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Chrome Object Wrapper (COW) and System Only Wrapper (SOW) implementations in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 do not prevent modifications to a prototype, which allows remote attackers to obtain sensitive information from chrome objects or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Firefox | < 17.0.3 | 17.0.3 |
| mozilla Firefox | < 19.0 | 19.0 |
| mozilla seamonkey | < 2.16 | 2.16 |
| mozilla Thunderbird | < 17.0.3 | 17.0.3 |
| mozilla thunderbird esr | < 17.0.3 | 17.0.3 |
| opensuse | = 11.4 | No fix listed |
| opensuse | = 12.1 | No fix listed |
| opensuse | = 12.2 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.10 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
References
- openSUSE-SU-2013:0323 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2013:0324 mailing-list third-party-advisory vendor-advisory
- DSA-2699 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- USN-1729-1 third-party-advisory vendor-advisory
- USN-1729-2 third-party-advisory vendor-advisory
- USN-1748-1 third-party-advisory vendor-advisory
- bugzilla.mozilla.org issue-tracking patch vendor-advisory
- oval:org.mitre.oval:def:16861 signature third-party-advisory vdb-entry