CVE-2013-1709 - Mozilla: Document URI misrepresentation and masquerading (MFSA 2013-68)

Back Back to CVE browser

MEDIUM

Mozilla: Document URI misrepresentation and masquerading (MFSA 2013-68)

Published Aug 7, 2013

4.3

MEDIUM

CVSS 2.0

EPSS 1.33%

Description

Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly handle the interaction between FRAME elements and history, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving spoofing a relative location in a previously visited document.

Affected products

Red Hat Enterprise Linux 5

firefox-0:17.0.8-1.el5_9

Fixed · RHSA-2013:1140
Red Hat Enterprise Linux 5

thunderbird-0:17.0.8-5.el5_9

Fixed · RHSA-2013:1142
Red Hat Enterprise Linux 5

xulrunner-0:17.0.8-3.el5_9

Fixed · RHSA-2013:1140
Red Hat Enterprise Linux 6

firefox-0:17.0.8-1.el6_4

Fixed · RHSA-2013:1140
Red Hat Enterprise Linux 6

thunderbird-0:17.0.8-5.el6_4

Fixed · RHSA-2013:1142
Red Hat Enterprise Linux 6

xulrunner-0:17.0.8-3.el6_4

Fixed · RHSA-2013:1140
Red Hat Enterprise Linux 5

thunderbird

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	firefox-0:17.0.8-1.el5_9	Fixed	RHSA-2013:1140
Red Hat Enterprise Linux 5	thunderbird-0:17.0.8-5.el5_9	Fixed	RHSA-2013:1142
Red Hat Enterprise Linux 5	xulrunner-0:17.0.8-3.el5_9	Fixed	RHSA-2013:1140
Red Hat Enterprise Linux 6	firefox-0:17.0.8-1.el6_4	Fixed	RHSA-2013:1140
Red Hat Enterprise Linux 6	thunderbird-0:17.0.8-5.el6_4	Fixed	RHSA-2013:1142
Red Hat Enterprise Linux 6	xulrunner-0:17.0.8-3.el6_4	Fixed	RHSA-2013:1140
Red Hat Enterprise Linux 5	thunderbird	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (10)

http://www.debian.org/security/2013/dsa-2735
vendor-advisoryx_refsource_DEBIAN
http://www.debian.org/security/2013/dsa-2746
vendor-advisoryx_refsource_DEBIAN
http://www.mozilla.org/security/announce/2013/mfsa2013-68.html
x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/61867
vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2013-1709
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=848253
x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=993600
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2013-1709
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18531
vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2013-1709

Link	Providers	Tags
http://www.debian.org/security/2013/dsa-2735		vendor-advisoryx_refsource_DEBIAN
http://www.debian.org/security/2013/dsa-2746		vendor-advisoryx_refsource_DEBIAN
http://www.mozilla.org/security/announce/2013/mfsa2013-68.html		x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/61867		vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2013-1709		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=848253		x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=993600		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2013-1709
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18531		vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2013-1709