Vulnerability-Lookup

CVE-2013-0787 (GCVE-0-2013-0787)

Vulnerability from cvelistv5 – Published: 2013-03-11 10:00 – Updated: 2024-08-06 14:41

Summary

Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call.

Severity

No CVSS data available.

CWE

Assigner

mozilla mitre root

References

16 references

URL	Tags
http://www.ubuntu.com/usn/USN-1758-1	vendor-advisoryx_refsource_UBUNTU
http://www.debian.org/security/2013/dsa-2699	vendor-advisoryx_refsource_DEBIAN
http://twitter.com/VUPEN/statuses/309505403631325184	x_refsource_MISC
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://twitter.com/thezdi/statuses/309484730506698752	x_refsource_MISC
http://www.securityfocus.com/bid/58391	vdb-entryx_refsource_BID
https://bugzilla.mozilla.org/show_bug.cgi?id=848644	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2013-0614.html	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://www.mozilla.org/security/announce/2013/mfs…	x_refsource_CONFIRM
http://rhn.redhat.com/errata/RHSA-2013-0627.html	vendor-advisoryx_refsource_REDHAT
http://h30499.www3.hp.com/t5/HP-Security-Research…	x_refsource_MISC

Date Public

2013-03-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T14:41:47.266Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-1758-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1758-1"
          },
          {
            "name": "DSA-2699",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2013/dsa-2699"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
          },
          {
            "name": "oval:org.mitre.oval:def:16737",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://twitter.com/thezdi/statuses/309484730506698752"
          },
          {
            "name": "58391",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/58391"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
          },
          {
            "name": "RHSA-2013:0614",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
          },
          {
            "name": "openSUSE-SU-2013:0468",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
          },
          {
            "name": "openSUSE-SU-2013:0465",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
          },
          {
            "name": "openSUSE-SU-2013:0467",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
          },
          {
            "name": "openSUSE-SU-2013:0431",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
          },
          {
            "name": "SUSE-SU-2013:0470",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
          },
          {
            "name": "RHSA-2013:0627",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2013-03-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-18T12:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "USN-1758-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1758-1"
        },
        {
          "name": "DSA-2699",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2013/dsa-2699"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
        },
        {
          "name": "oval:org.mitre.oval:def:16737",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://twitter.com/thezdi/statuses/309484730506698752"
        },
        {
          "name": "58391",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/58391"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
        },
        {
          "name": "RHSA-2013:0614",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
        },
        {
          "name": "openSUSE-SU-2013:0468",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
        },
        {
          "name": "openSUSE-SU-2013:0465",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
        },
        {
          "name": "openSUSE-SU-2013:0467",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
        },
        {
          "name": "openSUSE-SU-2013:0431",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
        },
        {
          "name": "SUSE-SU-2013:0470",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
        },
        {
          "name": "RHSA-2013:0627",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2013-0787",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-1758-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1758-1"
            },
            {
              "name": "DSA-2699",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2013/dsa-2699"
            },
            {
              "name": "http://twitter.com/VUPEN/statuses/309505403631325184",
              "refsource": "MISC",
              "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
            },
            {
              "name": "oval:org.mitre.oval:def:16737",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
            },
            {
              "name": "http://twitter.com/thezdi/statuses/309484730506698752",
              "refsource": "MISC",
              "url": "http://twitter.com/thezdi/statuses/309484730506698752"
            },
            {
              "name": "58391",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/58391"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
            },
            {
              "name": "RHSA-2013:0614",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
            },
            {
              "name": "openSUSE-SU-2013:0468",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
            },
            {
              "name": "openSUSE-SU-2013:0465",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
            },
            {
              "name": "openSUSE-SU-2013:0467",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
            },
            {
              "name": "openSUSE-SU-2013:0431",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
            },
            {
              "name": "SUSE-SU-2013:0470",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
            },
            {
              "name": "RHSA-2013:0627",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
            },
            {
              "name": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
              "refsource": "MISC",
              "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2013-0787",
    "datePublished": "2013-03-11T10:00:00.000Z",
    "dateReserved": "2013-01-02T00:00:00.000Z",
    "dateUpdated": "2024-08-06T14:41:47.266Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2013-0787",
      "date": "2026-09-18",
      "epss": "0.06398",
      "percentile": "0.93347"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "254BCF5F-C79D-4D88-A937-913FD01E017C",
                    "versionEndIncluding": "19.0.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3283FBAC-B77A-4C62-9D51-70BB35FA3D13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "886D8A1F-ECDD-4FE9-A4E5-2322EEC0B880",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E10B8803-C319-4AAA-81CF-FA206A33BA55",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E2B5567C-8969-456D-B6DF-3562B99C41FE",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "719210EC-B94E-447B-BEC9-598A02E65C68",
                    "versionEndIncluding": "17.0.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C2FD78A8-0D3A-412C-8776-20C598697564",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "777D8DC5-8D43-4842-B0A7-3C933F41F6E8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "808C66D2-4C53-4544-AD21-443D9A400B84",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "341D94CE-C0EB-47FA-A043-E7B0F4344BBB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "84C3EE07-F201-451A-89A1-A41B8B2165E6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "45837B42-7D29-4475-94F1-E29CD5831C7F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7028A433-7D1B-4C6F-A0F6-1B69682F7853",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F214CD49-A7BC-4D17-ADCD-FDF995B9B61A",
                    "versionEndIncluding": "2.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta1:*:*:*:*:*:*",
                    "matchCriteriaId": "7AF84523-CBF7-4F1D-9818-9DAFED30851D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta2:*:*:*:*:*:*",
                    "matchCriteriaId": "51C344C3-093D-486E-B2BA-47E890FC159B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta3:*:*:*:*:*:*",
                    "matchCriteriaId": "D7D8ED22-2F5A-408E-995F-D6B046250EC7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta4:*:*:*:*:*:*",
                    "matchCriteriaId": "D7744088-C55D-4006-8A1C-545DF9687A5A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta5:*:*:*:*:*:*",
                    "matchCriteriaId": "B888F4F3-F5C1-47CB-85EA-BF088B3629FD",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad en la gesti\u00f3n de recursos en la funci\u00f3n nsEditor::IsPreformatted en editor/libeditor/base/nsEditor.cpp en Mozilla Firefox anterior a v19.0.2, Firefox ESR v17.x anterior a v17.0.4, Thunderbird anterior a v17.0.4, Thunderbird ESR v17.x anterior a v17.0.4, y SeaMonkey anterior a v2.16.1 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores relacionados con la llamada execCommand."
          }
        ],
        "id": "CVE-2013-0787",
        "lastModified": "2026-04-29T01:13:23.040",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 9.3,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 10.0,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ]
        },
        "published": "2013-03-11T10:55:00.990",
        "references": [
          {
            "source": "security@mozilla.org",
            "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://twitter.com/thezdi/statuses/309484730506698752"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://www.debian.org/security/2013/dsa-2699"
          },
          {
            "source": "security@mozilla.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://www.securityfocus.com/bid/58391"
          },
          {
            "source": "security@mozilla.org",
            "url": "http://www.ubuntu.com/usn/USN-1758-1"
          },
          {
            "source": "security@mozilla.org",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
          },
          {
            "source": "security@mozilla.org",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://twitter.com/thezdi/statuses/309484730506698752"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.debian.org/security/2013/dsa-2699"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/58391"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.ubuntu.com/usn/USN-1758-1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
          }
        ],
        "sourceIdentifier": "security@mozilla.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-399"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Critical",
      "current_release_date": "2026-06-28T11:07:01+00:00",
      "cve": "CVE-2013-0787",
      "id": "CVE-2013-0787",
      "initial_release_date": "2013-03-08T00:00:00+00:00",
      "product_status:fixed": "99",
      "product_status:known_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Mozilla: Use-after-free in HTML Editor (MFSA 2013-29)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2013/cve-2013-0787.json",
      "version": "3"
    }
  }
}

CERTA-2013-AVI-171

Vulnerability from certfr_avis - Published: 2013-03-08 - Updated: 2013-03-08

Une vulnérabilité a été corrigée dans les produits Mozilla Firefox. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance au moyen de la fonction javascript document.execCommand().

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Mozilla	Thunderbird	Versions antérieures à Thunderbird 17.0.4
Mozilla	N/A	Versions antérieures à SeaMonkey 2.16.1
Mozilla	Firefox ESR	Versions antérieures à Firefox ESR 17.0.4
Mozilla	Firefox	Versions antérieures à Firefox 19.0.2
Mozilla	Thunderbird	Versions antérieures à Thunderbird ESR 17.0.4

References

Title

Publication Time

FKIE_CVE-2013-0787

Vulnerability from fkie_nvd - Published: 2013-03-11 10:55 - Updated: 2026-06-16 23:50

Severity

Summary

References

URL	Tags
security@mozilla.org	http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
security@mozilla.org	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html
security@mozilla.org	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html
security@mozilla.org	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html
security@mozilla.org	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html
security@mozilla.org	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html
security@mozilla.org	http://rhn.redhat.com/errata/RHSA-2013-0614.html
security@mozilla.org	http://rhn.redhat.com/errata/RHSA-2013-0627.html
security@mozilla.org	http://twitter.com/VUPEN/statuses/309505403631325184
security@mozilla.org	http://twitter.com/thezdi/statuses/309484730506698752
security@mozilla.org	http://www.debian.org/security/2013/dsa-2699
security@mozilla.org	http://www.mozilla.org/security/announce/2013/mfsa2013-29.html	Vendor Advisory
security@mozilla.org	http://www.securityfocus.com/bid/58391
security@mozilla.org	http://www.ubuntu.com/usn/USN-1758-1
security@mozilla.org	https://bugzilla.mozilla.org/show_bug.cgi?id=848644
security@mozilla.org	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737
af854a3a-2127-422b-91ae-364da2661108	http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html
af854a3a-2127-422b-91ae-364da2661108	http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2013-0614.html
af854a3a-2127-422b-91ae-364da2661108	http://rhn.redhat.com/errata/RHSA-2013-0627.html
af854a3a-2127-422b-91ae-364da2661108	http://twitter.com/VUPEN/statuses/309505403631325184
af854a3a-2127-422b-91ae-364da2661108	http://twitter.com/thezdi/statuses/309484730506698752
af854a3a-2127-422b-91ae-364da2661108	http://www.debian.org/security/2013/dsa-2699
af854a3a-2127-422b-91ae-364da2661108	http://www.mozilla.org/security/announce/2013/mfsa2013-29.html	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/58391
af854a3a-2127-422b-91ae-364da2661108	http://www.ubuntu.com/usn/USN-1758-1
af854a3a-2127-422b-91ae-364da2661108	https://bugzilla.mozilla.org/show_bug.cgi?id=848644
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737

Impacted products

Vendor	Product	Version
mozilla	firefox	*
mozilla	firefox	19.0
mozilla	firefox	17.0
mozilla	firefox	17.0.1
mozilla	firefox	17.0.2
mozilla	firefox	17.0.3
mozilla	thunderbird	*
mozilla	thunderbird	17.0
mozilla	thunderbird	17.0.1
mozilla	thunderbird	17.0.2
mozilla	thunderbird_esr	17.0
mozilla	thunderbird_esr	17.0.1
mozilla	thunderbird_esr	17.0.2
mozilla	thunderbird_esr	17.0.3
mozilla	seamonkey	*
mozilla	seamonkey	2.16
mozilla	seamonkey	2.16
mozilla	seamonkey	2.16
mozilla	seamonkey	2.16
mozilla	seamonkey	2.16

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "security@mozilla.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "254BCF5F-C79D-4D88-A937-913FD01E017C",
              "versionEndIncluding": "19.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3283FBAC-B77A-4C62-9D51-70BB35FA3D13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "886D8A1F-ECDD-4FE9-A4E5-2322EEC0B880",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E10B8803-C319-4AAA-81CF-FA206A33BA55",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2B5567C-8969-456D-B6DF-3562B99C41FE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "719210EC-B94E-447B-BEC9-598A02E65C68",
              "versionEndIncluding": "17.0.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C2FD78A8-0D3A-412C-8776-20C598697564",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "777D8DC5-8D43-4842-B0A7-3C933F41F6E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "808C66D2-4C53-4544-AD21-443D9A400B84",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "341D94CE-C0EB-47FA-A043-E7B0F4344BBB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "84C3EE07-F201-451A-89A1-A41B8B2165E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "45837B42-7D29-4475-94F1-E29CD5831C7F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7028A433-7D1B-4C6F-A0F6-1B69682F7853",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F214CD49-A7BC-4D17-ADCD-FDF995B9B61A",
              "versionEndIncluding": "2.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "7AF84523-CBF7-4F1D-9818-9DAFED30851D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "51C344C3-093D-486E-B2BA-47E890FC159B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "D7D8ED22-2F5A-408E-995F-D6B046250EC7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "D7744088-C55D-4006-8A1C-545DF9687A5A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "B888F4F3-F5C1-47CB-85EA-BF088B3629FD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en la gesti\u00f3n de recursos en la funci\u00f3n nsEditor::IsPreformatted en editor/libeditor/base/nsEditor.cpp en Mozilla Firefox anterior a v19.0.2, Firefox ESR v17.x anterior a v17.0.4, Thunderbird anterior a v17.0.4, Thunderbird ESR v17.x anterior a v17.0.4, y SeaMonkey anterior a v2.16.1 permite a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores relacionados con la llamada execCommand."
    }
  ],
  "id": "CVE-2013-0787",
  "lastModified": "2026-06-16T23:50:05.740",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2013-03-11T10:55:00.990",
  "references": [
    {
      "source": "security@mozilla.org",
      "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://twitter.com/thezdi/statuses/309484730506698752"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://www.debian.org/security/2013/dsa-2699"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://www.securityfocus.com/bid/58391"
    },
    {
      "source": "security@mozilla.org",
      "url": "http://www.ubuntu.com/usn/USN-1758-1"
    },
    {
      "source": "security@mozilla.org",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
    },
    {
      "source": "security@mozilla.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://twitter.com/thezdi/statuses/309484730506698752"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.debian.org/security/2013/dsa-2699"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/58391"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-1758-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
    }
  ],
  "sourceIdentifier": "security@mozilla.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-HP7J-MMG2-C8G7

Vulnerability from github – Published: 2022-05-17 00:56 – Updated: 2022-05-17 00:56

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-0787"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-03-11T10:55:00Z",
    "severity": "HIGH"
  },
  "details": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call.",
  "id": "GHSA-hp7j-mmg2-c8g7",
  "modified": "2022-05-17T00:56:59Z",
  "published": "2022-05-17T00:56:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0787"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
    },
    {
      "type": "WEB",
      "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
    },
    {
      "type": "WEB",
      "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
    },
    {
      "type": "WEB",
      "url": "http://twitter.com/thezdi/statuses/309484730506698752"
    },
    {
      "type": "WEB",
      "url": "http://www.debian.org/security/2013/dsa-2699"
    },
    {
      "type": "WEB",
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/58391"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-1758-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2013-0787

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2013-0787

Aliases

CVE-2013-0787

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2013-0787",
    "description": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call.",
    "id": "GSD-2013-0787",
    "references": [
      "https://www.suse.com/security/cve/CVE-2013-0787.html",
      "https://www.debian.org/security/2013/dsa-2699",
      "https://access.redhat.com/errata/RHSA-2013:0627",
      "https://access.redhat.com/errata/RHSA-2013:0614",
      "https://linux.oracle.com/cve/CVE-2013-0787.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2013-0787"
      ],
      "details": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call.",
      "id": "GSD-2013-0787",
      "modified": "2023-12-13T01:22:14.792350Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@mozilla.org",
        "ID": "CVE-2013-0787",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "USN-1758-1",
            "refsource": "UBUNTU",
            "url": "http://www.ubuntu.com/usn/USN-1758-1"
          },
          {
            "name": "DSA-2699",
            "refsource": "DEBIAN",
            "url": "http://www.debian.org/security/2013/dsa-2699"
          },
          {
            "name": "http://twitter.com/VUPEN/statuses/309505403631325184",
            "refsource": "MISC",
            "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
          },
          {
            "name": "oval:org.mitre.oval:def:16737",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
          },
          {
            "name": "http://twitter.com/thezdi/statuses/309484730506698752",
            "refsource": "MISC",
            "url": "http://twitter.com/thezdi/statuses/309484730506698752"
          },
          {
            "name": "58391",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/58391"
          },
          {
            "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
          },
          {
            "name": "RHSA-2013:0614",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
          },
          {
            "name": "openSUSE-SU-2013:0468",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
          },
          {
            "name": "openSUSE-SU-2013:0465",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
          },
          {
            "name": "openSUSE-SU-2013:0467",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
          },
          {
            "name": "openSUSE-SU-2013:0431",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
          },
          {
            "name": "SUSE-SU-2013:0470",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
          },
          {
            "name": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html",
            "refsource": "CONFIRM",
            "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
          },
          {
            "name": "RHSA-2013:0627",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
          },
          {
            "name": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
            "refsource": "MISC",
            "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "19.0.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox_esr:17.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox_esr:17.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox_esr:17.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox_esr:17.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "17.0.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:2.16:beta4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:2.16:beta3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:2.16:beta2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:2.16:beta1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.16",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:seamonkey:2.16:beta5:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2013-0787"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-399"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://twitter.com/thezdi/statuses/309484730506698752",
              "refsource": "MISC",
              "tags": [],
              "url": "http://twitter.com/thezdi/statuses/309484730506698752"
            },
            {
              "name": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
              "refsource": "MISC",
              "tags": [],
              "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html"
            },
            {
              "name": "http://twitter.com/VUPEN/statuses/309505403631325184",
              "refsource": "MISC",
              "tags": [],
              "url": "http://twitter.com/VUPEN/statuses/309505403631325184"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644"
            },
            {
              "name": "USN-1758-1",
              "refsource": "UBUNTU",
              "tags": [],
              "url": "http://www.ubuntu.com/usn/USN-1758-1"
            },
            {
              "name": "openSUSE-SU-2013:0431",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html"
            },
            {
              "name": "RHSA-2013:0614",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html"
            },
            {
              "name": "RHSA-2013:0627",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html"
            },
            {
              "name": "openSUSE-SU-2013:0468",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html"
            },
            {
              "name": "SUSE-SU-2013:0470",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html"
            },
            {
              "name": "openSUSE-SU-2013:0465",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html"
            },
            {
              "name": "openSUSE-SU-2013:0467",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html"
            },
            {
              "name": "DSA-2699",
              "refsource": "DEBIAN",
              "tags": [],
              "url": "http://www.debian.org/security/2013/dsa-2699"
            },
            {
              "name": "58391",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/58391"
            },
            {
              "name": "oval:org.mitre.oval:def:16737",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 10.0,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2017-09-19T01:35Z",
      "publishedDate": "2013-03-11T10:55Z"
    }
  }
}

OPENSUSE-SU-2024:10071-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

MozillaFirefox-50.1.0-1.1 on GA media

Severity

Moderate

Scope

899 vulnerabilities in this advisory, including CVE-2013-0787.

CVE-2013-0787

Recommended: 24 products

Open the full advisory

OPENSUSE-SU-2024:10218-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

seamonkey-2.40-6.1 on GA media

Severity

Moderate

Scope

577 vulnerabilities in this advisory, including CVE-2013-0787.

CVE-2013-0787

Recommended: 20 products

Open the full advisory

OPENSUSE-SU-2024:10230-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00

Summary

MozillaThunderbird-45.5.1-1.1 on GA media

Severity

Moderate

Scope

560 vulnerabilities in this advisory, including CVE-2013-0787.

CVE-2013-0787

Recommended: 20 products

Open the full advisory

OPENSUSE-SU-2024:14572-1

Vulnerability from csaf_opensuse - Published: 2024-12-12 00:00 - Updated: 2024-12-12 00:00

Summary

firefox-esr-128.5.1-1.1 on GA media

Severity

Moderate

Scope

1860 vulnerabilities in this advisory, including CVE-2013-0787.

CVE-2013-0787

Recommended: 16 products

Open the full advisory

RHSA-2013:0614

Vulnerability from csaf_redhat - Published: 2013-03-08 12:17 - Updated: 2026-06-28 12:22

Summary

Red Hat Security Advisory: xulrunner security update

Severity

Critical

Scope

1 vulnerability in this advisory, including CVE-2013-0787.

CVE-2013-0787

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

Fixed: 75 products

https://access.redhat.com/errata/RHSA-2013:0614

Open the full advisory

RHSA-2013:0627

Vulnerability from csaf_redhat - Published: 2013-03-11 19:15 - Updated: 2026-06-28 12:22

Summary

Red Hat Security Advisory: thunderbird security update

Severity

Important

Scope

1 vulnerability in this advisory, including CVE-2013-0787.

CVE-2013-0787

6.8 ()


                
                  AV:N/AC:M/Au:N/C:P/I:P/A:P

Fixed: 24 products

https://access.redhat.com/errata/RHSA-2013:0627

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2013-0787 (GCVE-0-2013-0787)

Solution

Tags

Sightings

Nomenclature

Related by attack behaviour