CVE-2013-5595
En bref
- Source
- NVD
- EPSS
- EPSS 2.09 % · centile 82 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mozilla
- Statut NVD
- Modified
Description
The JavaScript engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly allocate memory for unspecified functions, which allows remote attackers to conduct buffer overflow attacks via a crafted web page.
Faiblesses (CWE)
- CWE-119 — Opération hors des limites d'un tampon mémoire
Références
- http://www.securityfocus.com/bid/63421
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18694
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html
- http://www.mozilla.org/security/announce/2013/mfsa2013-96.html
- https://security.gentoo.org/glsa/201504-01
- https://bugzilla.mozilla.org/show_bug.cgi?id=916580
- http://rhn.redhat.com/errata/RHSA-2013-1480.html
- http://rhn.redhat.com/errata/RHSA-2013-1476.html
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html
- http://www.debian.org/security/2013/dsa-2788
- http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00014.html
- http://www.debian.org/security/2013/dsa-2797
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2013-5435
- GCVE · GCVE-0-2013-5595
Avis du CERT-FR
- CERTA-2013-AVI-613 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird_esr:17.0.4:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird_esr:17.0.5:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird_esr:17.0.6:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird_esr:17.0.7:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird_esr:17.0.8:*:*:*:*:*:*:*cpe:2.3:a:mozilla:thunderbird_esr:17.0.9:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*≤ 24.0cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:21.0:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:22.0:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:23.0:*:*:*:*:*:*:*cpe:2.3:a:mozilla:firefox:23.0.1:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:*:beta2:*:*:*:*:*:*≤ 2.22cpe:2.3:a:mozilla:seamonkey:2.0:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0:alpha_1:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0:alpha_2:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0:alpha_3:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0:beta_1:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0:beta_2:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0:rc1:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0:rc2:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.1:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.2:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.3:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.4:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.5:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.6:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.7:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.8:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.9:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.10:*:*:*:*:*:*:*cpe:2.3:a:mozilla:seamonkey:2.0.11:*:*:*:*:*:*:*- +108 autres
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |