CVE-2013-1675
CVE-2013-1675
In short
Mozilla Firefox and Thunderbird versions before 21.0 don't properly initialize certain memory structures when handling SVG zoom events, allowing attackers to read sensitive data from the browser's memory through a malicious website.
Technical detail
Uninitialized data structures in nsDOMSVGZoomEvent's mPreviousScale and mNewScale functions permit information disclosure via memory leakage. An attacker can craft a malicious SVG-containing webpage to trigger zoom events and access uninitialized heap memory containing sensitive data. This requires user interaction (visiting a crafted site) and affects Firefox <21.0 and Thunderbird <17.0.6.
Summary generated and translated by AI from the official description.
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
n/a · n/aWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0820.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0821.htmlhttps://bugzilla.mozilla.org/show_bug.cgi?id=866825https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1675http://www.debian.org/security/2013/dsa-2699http://www.mandriva.com/security/advisories?name=MDVSA-2013:165