{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-06-25T00:00:00", "descriptions": [{"lang": "en", "value": "The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-18T12:57:01", "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla"}, "references": [{"name": "oval:org.mitre.oval:def:17117", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17117"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=866823"}, {"name": "USN-1890-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-1890-1"}, {"name": "RHSA-2013:0982", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"}, {"name": "SUSE-SU-2013:1153", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-51.html"}, {"name": "SUSE-SU-2013:1152", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"}, {"name": "RHSA-2013:0981", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"}, {"name": "USN-1891-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-1891-1"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=863933"}, {"name": "openSUSE-SU-2013:1141", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"}, {"name": "DSA-2716", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2013/dsa-2716"}, {"name": "openSUSE-SU-2013:1142", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"}, {"name": "openSUSE-SU-2013:1140", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"}, {"name": "DSA-2720", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2013/dsa-2720"}, {"name": "60777", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/60777"}, {"name": "openSUSE-SU-2013:1143", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@mozilla.org", "ID": "CVE-2013-1687", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "oval:org.mitre.oval:def:17117", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17117"}, {"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=866823", "refsource": "CONFIRM", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=866823"}, {"name": "USN-1890-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1890-1"}, {"name": "RHSA-2013:0982", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"}, {"name": "SUSE-SU-2013:1153", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"}, {"name": "http://www.mozilla.org/security/announce/2013/mfsa2013-51.html", "refsource": "CONFIRM", "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-51.html"}, {"name": "SUSE-SU-2013:1152", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"}, {"name": "RHSA-2013:0981", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"}, {"name": "USN-1891-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1891-1"}, {"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=863933", "refsource": "CONFIRM", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=863933"}, {"name": "openSUSE-SU-2013:1141", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"}, {"name": "DSA-2716", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2013/dsa-2716"}, {"name": "openSUSE-SU-2013:1142", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"}, {"name": "openSUSE-SU-2013:1140", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"}, {"name": "DSA-2720", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2013/dsa-2720"}, {"name": "60777", "refsource": "BID", "url": "http://www.securityfocus.com/bid/60777"}, {"name": "openSUSE-SU-2013:1143", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"}]}}}}, "cveMetadata": {"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "cveId": "CVE-2013-1687", "datePublished": "2013-06-26T01:00:00", "dateReserved": "2013-02-13T00:00:00", "dateUpdated": "2017-09-18T12:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "29071754-CC8F-42D9-82D4-140236802506", "versionEndIncluding": "21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*", "matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "DE09D089-7F48-466B-B03A-C64152A12615", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "653D73DA-21C0-4C3F-9269-5A6D5C5B1E34", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*", "matchCriteriaId": "804A0ACE-EB28-413D-93F4-E849FEA01390", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "3BA49C6F-9115-41A5-BBDE-743CB9DEDDA8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox_esr:17.0:*:*:*:*:*:*:*", "matchCriteriaId": "D9BBC7F8-D102-403F-8A88-AF279536E2F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:17.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "DFDAC701-5E69-4633-8CE4-04B8AFCC10C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:17.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "83D5CFC4-C5DD-4747-985A-BC7A8E7C6EF7", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:17.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "D5AFA78C-71F3-4E64-8A8F-5BA028F04037", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:17.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "F99963C6-175B-4099-86F4-BADCA43DB41F", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:17.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "96530DB0-8A9E-48FD-A5C5-28FD467568B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox_esr:17.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "9B0AC5E6-F4E3-41A9-A611-A0FAF11ABF68", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C8122DC-6877-4EC8-8041-B579FC5AC6CA", "versionEndIncluding": "17.0.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*", "matchCriteriaId": "C2FD78A8-0D3A-412C-8776-20C598697564", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "777D8DC5-8D43-4842-B0A7-3C933F41F6E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "808C66D2-4C53-4544-AD21-443D9A400B84", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "6FB95E8B-CF01-471F-8306-BB9FB0896904", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "AF7E092E-BCBE-48B4-8F6A-D3E4A0369AE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "BB1D90B0-9E81-4828-8122-A66FB0953863", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*", "matchCriteriaId": "341D94CE-C0EB-47FA-A043-E7B0F4344BBB", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "84C3EE07-F201-451A-89A1-A41B8B2165E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "45837B42-7D29-4475-94F1-E29CD5831C7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "7028A433-7D1B-4C6F-A0F6-1B69682F7853", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "86C07513-8F98-4FA6-837D-7D735AE5EA91", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "E1D87C70-0EC2-49DE-A59D-CAF22760BC9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "61AE2EAA-55A4-4FC9-BC3F-0FEE5BB2DE99", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site."}, {"lang": "es", "value": "Las implementaciones System Only Wrapper (SOW) y Chrome Object Wrapper (COW) en Mozilla Firefox anterior a v22.0, Firefox ESR v17.x anterior a v17.0.7, Thunderbird anterior a v17.0.7, y Thunderbird ESR v17.x anterior a v17.0.7 no restringen adecuadamente las funciones XBL definidas por el usuario lo que permite a atacantes remotos ejecutar c\u00f3digo JavaScript con privilegios de chrome, o llevar a cabo ataques de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) a trav\u00e9s de un sitios web manipulado."}], "id": "CVE-2013-1687", "lastModified": "2017-09-19T01:36:10.810", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2013-06-26T03:19:10.757", "references": [{"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"}, {"source": "security@mozilla.org", "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"}, {"source": "security@mozilla.org", "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"}, {"source": "security@mozilla.org", "url": "http://www.debian.org/security/2013/dsa-2716"}, {"source": "security@mozilla.org", "url": "http://www.debian.org/security/2013/dsa-2720"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-51.html"}, {"source": "security@mozilla.org", "url": "http://www.securityfocus.com/bid/60777"}, {"source": "security@mozilla.org", "url": "http://www.ubuntu.com/usn/USN-1890-1"}, {"source": "security@mozilla.org", "url": "http://www.ubuntu.com/usn/USN-1891-1"}, {"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=863933"}, {"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=866823"}, {"source": "security@mozilla.org", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17117"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}