PT-2013-5683 · Mozilla+4 · Firefox+5

Daniel Veditz + 1 · Published 2013-12-10 · Updated 2024-12-12 · CVE-2013-5614

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 26.0 SeaMonkey versions prior to 2.23

Description The issue allows remote attackers to bypass intended sandbox restrictions via a crafted web site, due to improper consideration of the sandbox attribute of an IFRAME element during processing of a contained OBJECT element.

Recommendations For Mozilla Firefox versions prior to 26.0, update to version 26.0 or later to resolve the issue. For SeaMonkey versions prior to 2.23, update to version 2.23 or later to resolve the issue.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

ALT-PU-2013-1333

ALT-PU-2014-1201

CESA-2013_1812

CESA-2013_1823

CVE-2013-5614

MGASA-2014-0048

OPENSUSE-SU-2014_1100-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

RHSA-2013:1812

RHSA-2013:1823

RHSA-2013_1812

RHSA-2013_1823

Affected Products

Alt Linux

Centos

Firefox

Red Hat

Seamonkey

Suse

References · 3175

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_proto_crmfrequest.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_onreadystatechange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_tostring_console_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_attribchildremoved.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_webidl_injection.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_nssvgvalue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_firefox_xmlserializer.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_interleaved_write.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/firefox_svg_plugin.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/mozilla_reduceright.rb · Exploit
• 🔥 https://github.com/vlad902/annotated-fbi-tbb-exploit · Exploit
• 🔥 https://github.com/argp/cve-2011-3026-firefox · Exploit
• 🔥 https://github.com/mk219533/CVE-2010-1205 · Exploit
• 🔥 https://github.com/johnwchadwick/cve-2009-3555-test-server · Exploit
• https://bdu.fstec.ru/vul/2015-06203 · Security Note