CVE-2013-0758

CVE-2013-0758

Published · Updated

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 73%
from disclosure to weapon0 days
Published on NVDJan 13
1st PoCJan 8
metasploitJan 8
exploitation probability
73%top 1% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat Enterprise Linux 5
none_available: Affected
Fixed
9 products (140 components)
Red Hat Enterprise Linux (v. 5 server) · Red Hat Enterprise Linux Server (v. 6) · Red Hat Enterprise Linux Server Optional (v. 6) · Red Hat Enterprise Linux Desktop (v. 6) · Red Hat Enterprise Linux Workstation (v. 6) · and others 4
fix ↗
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.
Affected products
n/a · n/a
public PoCs found — 2✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/41684exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/41683
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0144.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0145.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=813906https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17087http://www.mozilla.org/security/announce/2013/mfsa2013-15.htmlhttp://www.ubuntu.com/usn/USN-1681-1http://www.ubuntu.com/usn/USN-1681-2http://www.ubuntu.com/usn/USN-1681-4