PT-2013-5677 · Mozilla+4 · Firefox+6

Wan-Teh Chang · Published 2013-11-15 · Updated 2024-10-21 · CVE-2013-5607

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 25.0.1 Mozilla Firefox ESR 17.x versions prior to 17.0.11 Mozilla Firefox ESR 24.x versions prior to 24.1.1 SeaMonkey versions prior to 2.22.1 NSPR versions prior to 4.10.2

Description The issue is related to an integer overflow in the PL ArenaAllocate function, which can be triggered by a crafted X.509 certificate. This can cause a denial of service, resulting in an application crash, and may have other unspecified impacts.

Recommendations For Mozilla Firefox versions prior to 25.0.1, update to version 25.0.1 or later. For Mozilla Firefox ESR 17.x versions prior to 17.0.11, update to version 17.0.11 or later. For Mozilla Firefox ESR 24.x versions prior to 24.1.1, update to version 24.1.1 or later. For SeaMonkey versions prior to 2.22.1, update to version 2.22.1 or later. For NSPR versions prior to 4.10.2, update to version 4.10.2 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2013-1147

ALT-PU-2013-1150

ALT-PU-2014-1201

CESA-2013_1829

CVE-2013-5607

DSA-2820-1

MGASA-2013-0337

RHSA-2013:1791

RHSA-2013:1829

RHSA-2013_1791

RHSA-2013_1829

Affected Products

Alt Linux

Centos

Firefox

Nspr

Red Hat

Seamonkey

Suse

References · 142

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• https://bdu.fstec.ru/vul/2015-02928 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1702 · Security Note
• https://osv.dev/vulnerability/CVE-2013-5607 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5606 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5618 · Security Note
• http://mozilla.org/security/announce/2013/mfsa2013-103.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09076 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5590 · Security Note
• https://bdu.fstec.ru/vul/2015-09078 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1726 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5600 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1735 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6674 · Security Note