CVE-2013-1710 - Mozilla: CRMF requests allow for code execution and XSS attacks (MFSA 2013-69)

Back Back to CVE browser

HIGH

Mozilla: CRMF requests allow for code execution and XSS attacks (MFSA 2013-69)

Published Aug 7, 2013

10.0

HIGH

CVSS 2.0

EPSS 40.12%

Description

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.

Affected products

Red Hat Enterprise Linux 5

firefox-0:17.0.8-1.el5_9

Fixed · RHSA-2013:1140
Red Hat Enterprise Linux 5

thunderbird-0:17.0.8-5.el5_9

Fixed · RHSA-2013:1142
Red Hat Enterprise Linux 5

xulrunner-0:17.0.8-3.el5_9

Fixed · RHSA-2013:1140
Red Hat Enterprise Linux 6

firefox-0:17.0.8-1.el6_4

Fixed · RHSA-2013:1140
Red Hat Enterprise Linux 6

thunderbird-0:17.0.8-5.el6_4

Fixed · RHSA-2013:1142
Red Hat Enterprise Linux 6

xulrunner-0:17.0.8-3.el6_4

Fixed · RHSA-2013:1140
Red Hat Enterprise Linux 5

thunderbird

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	firefox-0:17.0.8-1.el5_9	Fixed	RHSA-2013:1140
Red Hat Enterprise Linux 5	thunderbird-0:17.0.8-5.el5_9	Fixed	RHSA-2013:1142
Red Hat Enterprise Linux 5	xulrunner-0:17.0.8-3.el5_9	Fixed	RHSA-2013:1140
Red Hat Enterprise Linux 6	firefox-0:17.0.8-1.el6_4	Fixed	RHSA-2013:1140
Red Hat Enterprise Linux 6	thunderbird-0:17.0.8-5.el6_4	Fixed	RHSA-2013:1142
Red Hat Enterprise Linux 6	xulrunner-0:17.0.8-3.el6_4	Fixed	RHSA-2013:1140
Red Hat Enterprise Linux 5	thunderbird	Affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-79

Cross-site Scripting (XSS)

References (10)

http://www.debian.org/security/2013/dsa-2735
vendor-advisoryx_refsource_DEBIAN
http://www.debian.org/security/2013/dsa-2746
vendor-advisoryx_refsource_DEBIAN
http://www.mozilla.org/security/announce/2013/mfsa2013-69.html
x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/61900
vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2013-1710
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=871368
x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=993602
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2013-1710
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18773
vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2013-1710

Link	Providers	Tags
http://www.debian.org/security/2013/dsa-2735		vendor-advisoryx_refsource_DEBIAN
http://www.debian.org/security/2013/dsa-2746		vendor-advisoryx_refsource_DEBIAN
http://www.mozilla.org/security/announce/2013/mfsa2013-69.html		x_refsource_CONFIRMVendor Advisory
http://www.securityfocus.com/bid/61900		vdb-entryx_refsource_BID
https://access.redhat.com/security/cve/CVE-2013-1710		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=871368		x_refsource_CONFIRM
https://bugzilla.redhat.com/show_bug.cgi?id=993602		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2013-1710
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18773		vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2013-1710