CVE-2013-5604 The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x befo...
HighCVSS 9.3
EPSS 6.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via crafted documents.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla thunderbird esr | = 17.0 | No fix listed |
| mozilla thunderbird esr | = 17.0.1 | No fix listed |
| mozilla thunderbird esr | = 17.0.2 | No fix listed |
| mozilla thunderbird esr | = 17.0.3 | No fix listed |
| mozilla thunderbird esr | = 17.0.4 | No fix listed |
| mozilla thunderbird esr | = 17.0.5 | No fix listed |
| mozilla thunderbird esr | = 17.0.6 | No fix listed |
| mozilla thunderbird esr | = 17.0.7 | No fix listed |
| mozilla thunderbird esr | = 17.0.8 | No fix listed |
| mozilla thunderbird esr | = 17.0.9 | No fix listed |
| mozilla seamonkey | <= 2.22 | No fix listed |
| mozilla seamonkey | = 2.0 | No fix listed |
| mozilla seamonkey | = 2.0-alpha_1 | No fix listed |
| mozilla seamonkey | = 2.0-alpha_2 | No fix listed |
| mozilla seamonkey | = 2.0-alpha_3 | No fix listed |
| mozilla seamonkey | = 2.0-beta_1 | No fix listed |
| mozilla seamonkey | = 2.0-beta_2 | No fix listed |
| mozilla seamonkey | = 2.0-rc1 | No fix listed |
| mozilla seamonkey | = 2.0-rc2 | No fix listed |
| mozilla seamonkey | = 2.0.1 | No fix listed |
| mozilla seamonkey | = 2.0.2 | No fix listed |
| mozilla seamonkey | = 2.0.3 | No fix listed |
| mozilla seamonkey | = 2.0.4 | No fix listed |
| mozilla seamonkey | = 2.0.5 | No fix listed |
| mozilla seamonkey | = 2.0.6 | No fix listed |
Show 123 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla seamonkey | = 2.0.7 | No fix listed |
| mozilla seamonkey | = 2.0.8 | No fix listed |
| mozilla seamonkey | = 2.0.9 | No fix listed |
| mozilla seamonkey | = 2.0.10 | No fix listed |
| mozilla seamonkey | = 2.0.11 | No fix listed |
| mozilla seamonkey | = 2.0.12 | No fix listed |
| mozilla seamonkey | = 2.0.13 | No fix listed |
| mozilla seamonkey | = 2.0.14 | No fix listed |
| mozilla seamonkey | = 2.1 | No fix listed |
| mozilla seamonkey | = 2.1-alpha1 | No fix listed |
| mozilla seamonkey | = 2.1-alpha2 | No fix listed |
| mozilla seamonkey | = 2.1-alpha3 | No fix listed |
| mozilla seamonkey | = 2.1-beta1 | No fix listed |
| mozilla seamonkey | = 2.1-beta2 | No fix listed |
| mozilla seamonkey | = 2.1-beta3 | No fix listed |
| mozilla seamonkey | = 2.1-rc1 | No fix listed |
| mozilla seamonkey | = 2.1-rc2 | No fix listed |
| mozilla seamonkey | = 2.10 | No fix listed |
| mozilla seamonkey | = 2.10-beta1 | No fix listed |
| mozilla seamonkey | = 2.10-beta2 | No fix listed |
| mozilla seamonkey | = 2.10-beta3 | No fix listed |
| mozilla seamonkey | = 2.10.1 | No fix listed |
| mozilla seamonkey | = 2.11 | No fix listed |
| mozilla seamonkey | = 2.11-beta1 | No fix listed |
| mozilla seamonkey | = 2.11-beta2 | No fix listed |
| mozilla seamonkey | = 2.11-beta3 | No fix listed |
| mozilla seamonkey | = 2.11-beta4 | No fix listed |
| mozilla seamonkey | = 2.11-beta5 | No fix listed |
| mozilla seamonkey | = 2.11-beta6 | No fix listed |
| mozilla seamonkey | = 2.12 | No fix listed |
| mozilla seamonkey | = 2.12-beta1 | No fix listed |
| mozilla seamonkey | = 2.12-beta2 | No fix listed |
| mozilla seamonkey | = 2.12-beta3 | No fix listed |
| mozilla seamonkey | = 2.12-beta4 | No fix listed |
| mozilla seamonkey | = 2.12-beta5 | No fix listed |
| mozilla seamonkey | = 2.12-beta6 | No fix listed |
| mozilla seamonkey | = 2.12.1 | No fix listed |
| mozilla seamonkey | = 2.13 | No fix listed |
| mozilla seamonkey | = 2.13-beta1 | No fix listed |
| mozilla seamonkey | = 2.13-beta2 | No fix listed |
| mozilla seamonkey | = 2.13-beta3 | No fix listed |
| mozilla seamonkey | = 2.13-beta4 | No fix listed |
| mozilla seamonkey | = 2.13-beta5 | No fix listed |
| mozilla seamonkey | = 2.13-beta6 | No fix listed |
| mozilla seamonkey | = 2.13.1 | No fix listed |
| mozilla seamonkey | = 2.13.2 | No fix listed |
| mozilla seamonkey | = 2.14 | No fix listed |
| mozilla seamonkey | = 2.14-beta1 | No fix listed |
| mozilla seamonkey | = 2.14-beta2 | No fix listed |
| mozilla seamonkey | = 2.14-beta3 | No fix listed |
| mozilla seamonkey | = 2.14-beta4 | No fix listed |
| mozilla seamonkey | = 2.14-beta5 | No fix listed |
| mozilla seamonkey | = 2.15 | No fix listed |
| mozilla seamonkey | = 2.15-beta1 | No fix listed |
| mozilla seamonkey | = 2.15-beta2 | No fix listed |
| mozilla seamonkey | = 2.15-beta3 | No fix listed |
| mozilla seamonkey | = 2.15-beta4 | No fix listed |
| mozilla seamonkey | = 2.15-beta5 | No fix listed |
| mozilla seamonkey | = 2.15-beta6 | No fix listed |
| mozilla seamonkey | = 2.15.1 | No fix listed |
| mozilla seamonkey | = 2.15.2 | No fix listed |
| mozilla seamonkey | = 2.16 | No fix listed |
| mozilla seamonkey | = 2.16-beta1 | No fix listed |
| mozilla seamonkey | = 2.16-beta2 | No fix listed |
| mozilla seamonkey | = 2.16-beta3 | No fix listed |
| mozilla seamonkey | = 2.16-beta4 | No fix listed |
| mozilla seamonkey | = 2.16-beta5 | No fix listed |
| mozilla seamonkey | = 2.16.1 | No fix listed |
| mozilla seamonkey | = 2.16.2 | No fix listed |
| mozilla seamonkey | = 2.17 | No fix listed |
| mozilla seamonkey | = 2.17-beta1 | No fix listed |
| mozilla seamonkey | = 2.17-beta2 | No fix listed |
| mozilla seamonkey | = 2.17-beta3 | No fix listed |
| mozilla seamonkey | = 2.17-beta4 | No fix listed |
| mozilla seamonkey | = 2.17.1 | No fix listed |
| mozilla seamonkey | = 2.18-beta1 | No fix listed |
| mozilla seamonkey | = 2.18-beta2 | No fix listed |
| mozilla seamonkey | = 2.18-beta3 | No fix listed |
| mozilla seamonkey | = 2.18-beta4 | No fix listed |
| mozilla seamonkey | = 2.19 | No fix listed |
| mozilla seamonkey | = 2.19-beta1 | No fix listed |
| mozilla seamonkey | = 2.19-beta2 | No fix listed |
| mozilla seamonkey | = 2.20 | No fix listed |
| mozilla seamonkey | = 2.20-beta1 | No fix listed |
| mozilla seamonkey | = 2.20-beta2 | No fix listed |
| mozilla seamonkey | = 2.20-beta3 | No fix listed |
| mozilla seamonkey | = 2.21-beta1 | No fix listed |
| mozilla seamonkey | = 2.21-beta2 | No fix listed |
| mozilla seamonkey | = 2.22-beta1 | No fix listed |
| mozilla Firefox | = 17.0 | No fix listed |
| mozilla Firefox | = 17.0.1 | No fix listed |
| mozilla Firefox | = 17.0.2 | No fix listed |
| mozilla Firefox | = 17.0.3 | No fix listed |
| mozilla Firefox | = 17.0.4 | No fix listed |
| mozilla Firefox | = 17.0.5 | No fix listed |
| mozilla Firefox | = 17.0.6 | No fix listed |
| mozilla Firefox | = 17.0.7 | No fix listed |
| mozilla Firefox | = 17.0.8 | No fix listed |
| mozilla Firefox | = 17.0.9 | No fix listed |
| mozilla Firefox | = 24.0 | No fix listed |
| mozilla Firefox | = 24.0.1 | No fix listed |
| mozilla Firefox | = 24.0.2 | No fix listed |
| mozilla Firefox | <= 24.0 | No fix listed |
| mozilla Firefox | = 19.0 | No fix listed |
| mozilla Firefox | = 19.0.1 | No fix listed |
| mozilla Firefox | = 19.0.2 | No fix listed |
| mozilla Firefox | = 20.0 | No fix listed |
| mozilla Firefox | = 20.0.1 | No fix listed |
| mozilla Firefox | = 21.0 | No fix listed |
| mozilla Firefox | = 22.0 | No fix listed |
| mozilla Firefox | = 23.0 | No fix listed |
| mozilla Firefox | = 23.0.1 | No fix listed |
| mozilla Thunderbird | <= 24.0.1 | No fix listed |
| mozilla Thunderbird | = 17.0 | No fix listed |
| mozilla Thunderbird | = 17.0.1 | No fix listed |
| mozilla Thunderbird | = 17.0.2 | No fix listed |
| mozilla Thunderbird | = 17.0.3 | No fix listed |
| mozilla Thunderbird | = 17.0.4 | No fix listed |
| mozilla Thunderbird | = 17.0.5 | No fix listed |
| mozilla Thunderbird | = 17.0.6 | No fix listed |
| mozilla Thunderbird | = 17.0.7 | No fix listed |
| mozilla Thunderbird | = 17.0.8 | No fix listed |
| mozilla Thunderbird | = 24.0 | No fix listed |
References
- openSUSE-SU-2013:1633 vendor-advisory
- openSUSE-SU-2013:1634 vendor-advisory
- SUSE-SU-2013:1678 vendor-advisory
- RHSA-2013:1476 vendor-advisory
- RHSA-2013:1480 vendor-advisory
- DSA-2788 vendor-advisory
- DSA-2797 vendor-advisory
- www.mozilla.org vendor-advisory
- bugzilla.mozilla.org
- oval:org.mitre.oval:def:19091 signature vdb-entry
- GLSA-201504-01 vendor-advisory