PT-2013-5683 · Mozilla+4 · Firefox+5

Daniel Veditz + 1 · Publicado 2013-12-10 · Atualizado 2024-12-12 · CVE-2013-5614

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 26.0 SeaMonkey versions prior to 2.23

Description The issue allows remote attackers to bypass intended sandbox restrictions via a crafted web site, due to improper consideration of the sandbox attribute of an IFRAME element during processing of a contained OBJECT element.

Recommendations For Mozilla Firefox versions prior to 26.0, update to version 26.0 or later to resolve the issue. For SeaMonkey versions prior to 2.23, update to version 2.23 or later to resolve the issue.

Exploit

Correção

Clickjacking

Enumeração de Fraquezas

CWE-1021

Identificadores relacionados

ALT-PU-2013-1333

ALT-PU-2014-1201

CESA-2013_1812

CESA-2013_1823

CVE-2013-5614

MGASA-2014-0048

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

RHSA-2013:1812

RHSA-2013:1823

RHSA-2013_1812

RHSA-2013_1823

Produtos afetados

Alt Linux

Centos

Firefox

Red Hat

Seamonkey

Suse

Referências · 3175

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/ssl/ssl_version.rb · Nota