Improper input validation in Mozilla Firefox
CVE-2013-1694
The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.046 (90.7th percentile) — read the EPSS interpretation.
Affected products
- Mozilla Firefox — versions 19.0, 19.0.1, 19.0.2
- Mozilla Thunderbird — versions 17.0, 17.0.1, 17.0.2
- Mozilla Thunderbird_esr — versions 17.0, 17.0.1, 17.0.2
- N/a — versions n/a
Weakness classification (CWE)
References
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory)
- security@mozilla.org (x_refsource_REDHAT, vendor-advisory)
- security@mozilla.org (x_refsource_CONFIRM)
- security@mozilla.org (signature, x_refsource_OVAL, vdb-entry)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (x_refsource_REDHAT, vendor-advisory)
- security@mozilla.org (x_refsource_UBUNTU, vendor-advisory)
- security@mozilla.org (vendor-advisory, x_refsource_SUSE)
- security@mozilla.org (vendor-advisory, x_refsource_DEBIAN)
- security@mozilla.org (vdb-entry, x_refsource_BID)