CISA KEV · Known exploitedHigh

CVE-2013-1690

Mozilla Firefox and Thunderbird

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

CVSS: 8.8
EPSS: 69.0%
CISA KEV: Listed
Published: 2013.06.26

PRIORITY ASSESSMENT

Immediate review

CISA has listed this vulnerability in the Known Exploited Vulnerabilities catalog.

Known exploitationConfirmed by CISA KEV

Exploit probability69.0%

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: Mozilla Firefox and Thunderbird
Affected versions: < 22.0, >= 17.0 < 17.0.7, < 17.0.7, 12.04, 12.10, 13.04, 7.0, 2.0, 5.0, 6.0, 5.9, 6.4, 11.4, 12.2, 12.3, 10, 11
Fixed versions: 22.0, 17.0.7

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

CISA required action

Apply updates per vendor instructions.

Due date: 2022.04.18

1
Identify
Confirm that Mozilla Firefox and Thunderbird and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE: CWE-119
KEV added: 2022.03.28
Ransomware use: 미확인