{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-06-25T00:00:00", "descriptions": [{"lang": "en", "value": "The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-18T12:57:01", "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla"}, "references": [{"name": "60784", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/60784"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101"}, {"name": "USN-1890-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-1890-1"}, {"name": "RHSA-2013:0982", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"}, {"name": "SUSE-SU-2013:1153", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"}, {"name": "SUSE-SU-2013:1152", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"}, {"name": "RHSA-2013:0981", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"}, {"name": "oval:org.mitre.oval:def:17243", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243"}, {"name": "USN-1891-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-1891-1"}, {"name": "openSUSE-SU-2013:1141", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html"}, {"name": "DSA-2716", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2013/dsa-2716"}, {"name": "openSUSE-SU-2013:1142", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"}, {"name": "openSUSE-SU-2013:1140", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"}, {"name": "DSA-2720", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2013/dsa-2720"}, {"name": "openSUSE-SU-2013:1143", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@mozilla.org", "ID": "CVE-2013-1697", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "60784", "refsource": "BID", "url": "http://www.securityfocus.com/bid/60784"}, {"name": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101", "refsource": "CONFIRM", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101"}, {"name": "USN-1890-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1890-1"}, {"name": "RHSA-2013:0982", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"}, {"name": "SUSE-SU-2013:1153", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"}, {"name": "SUSE-SU-2013:1152", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"}, {"name": "RHSA-2013:0981", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"}, {"name": "oval:org.mitre.oval:def:17243", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243"}, {"name": "USN-1891-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1891-1"}, {"name": "openSUSE-SU-2013:1141", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"}, {"name": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html", "refsource": "CONFIRM", "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html"}, {"name": "DSA-2716", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2013/dsa-2716"}, {"name": "openSUSE-SU-2013:1142", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"}, {"name": "openSUSE-SU-2013:1140", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"}, {"name": "DSA-2720", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2013/dsa-2720"}, {"name": "openSUSE-SU-2013:1143", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T15:13:32.298Z"}, "title": "CVE Program Container", "references": [{"name": "60784", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/60784"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101"}, {"name": "USN-1890-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-1890-1"}, {"name": "RHSA-2013:0982", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"}, {"name": "SUSE-SU-2013:1153", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"}, {"name": "SUSE-SU-2013:1152", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"}, {"name": "RHSA-2013:0981", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"}, {"name": "oval:org.mitre.oval:def:17243", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243"}, {"name": "USN-1891-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-1891-1"}, {"name": "openSUSE-SU-2013:1141", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html"}, {"name": "DSA-2716", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2013/dsa-2716"}, {"name": "openSUSE-SU-2013:1142", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"}, {"name": "openSUSE-SU-2013:1140", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"}, {"name": "DSA-2720", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2013/dsa-2720"}, {"name": "openSUSE-SU-2013:1143", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"}]}]}, "cveMetadata": {"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "assignerShortName": "mozilla", "cveId": "CVE-2013-1697", "datePublished": "2013-06-26T01:00:00", "dateReserved": "2013-02-13T00:00:00", "dateUpdated": "2024-08-06T15:13:32.298Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*", "matchCriteriaId": "29071754-CC8F-42D9-82D4-140236802506", "versionEndIncluding": "21.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*", "matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "DE09D089-7F48-466B-B03A-C64152A12615", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "653D73DA-21C0-4C3F-9269-5A6D5C5B1E34", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*", "matchCriteriaId": "804A0ACE-EB28-413D-93F4-E849FEA01390", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "3BA49C6F-9115-41A5-BBDE-743CB9DEDDA8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*", "matchCriteriaId": "3283FBAC-B77A-4C62-9D51-70BB35FA3D13", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "886D8A1F-ECDD-4FE9-A4E5-2322EEC0B880", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "E10B8803-C319-4AAA-81CF-FA206A33BA55", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "E2B5567C-8969-456D-B6DF-3562B99C41FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "5657779C-19F9-42B8-BBBD-292B898E8FD2", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "EEA3B9F4-BD8E-488B-A362-0B86BC6DA275", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:firefox:17.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "6A91BD4A-76BD-40B9-9E12-22CACAAE42BF", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C8122DC-6877-4EC8-8041-B579FC5AC6CA", "versionEndIncluding": "17.0.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*", "matchCriteriaId": "C2FD78A8-0D3A-412C-8776-20C598697564", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "777D8DC5-8D43-4842-B0A7-3C933F41F6E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "808C66D2-4C53-4544-AD21-443D9A400B84", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "6FB95E8B-CF01-471F-8306-BB9FB0896904", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "AF7E092E-BCBE-48B4-8F6A-D3E4A0369AE1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "BB1D90B0-9E81-4828-8122-A66FB0953863", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*", "matchCriteriaId": "341D94CE-C0EB-47FA-A043-E7B0F4344BBB", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "84C3EE07-F201-451A-89A1-A41B8B2165E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "45837B42-7D29-4475-94F1-E29CD5831C7F", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "7028A433-7D1B-4C6F-A0F6-1B69682F7853", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "86C07513-8F98-4FA6-837D-7D735AE5EA91", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "E1D87C70-0EC2-49DE-A59D-CAF22760BC9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "61AE2EAA-55A4-4FC9-BC3F-0FEE5BB2DE99", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method."}, {"lang": "es", "value": "La implementaci\u00f3n XrayWrapper en Mozilla Firefox anterior a v22.0, Firefox ESR v17.x antes de v17.0.7, Thunderbird anterior a v17.0.7 no restringe correctamente el uso de DefaultValue para las llamadas a m\u00e9todos, lo que permite a atacantes remotos ejecutar c\u00f3digo JavaScript con privilegios de chrome a trav\u00e9s de sitios web manipulados que dispara el uso de los m\u00e9todos user-defined (1) toString o (2) valueOf"}], "id": "CVE-2013-1697", "lastModified": "2024-11-21T01:50:10.810", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2013-06-26T03:19:10.903", "references": [{"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"}, {"source": "security@mozilla.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"}, {"source": "security@mozilla.org", "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"}, {"source": "security@mozilla.org", "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"}, {"source": "security@mozilla.org", "url": "http://www.debian.org/security/2013/dsa-2716"}, {"source": "security@mozilla.org", "url": "http://www.debian.org/security/2013/dsa-2720"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html"}, {"source": "security@mozilla.org", "url": "http://www.securityfocus.com/bid/60784"}, {"source": "security@mozilla.org", "url": "http://www.ubuntu.com/usn/USN-1890-1"}, {"source": "security@mozilla.org", "url": "http://www.ubuntu.com/usn/USN-1891-1"}, {"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101"}, {"source": "security@mozilla.org", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2013-0981.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2013-0982.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2013/dsa-2716"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2013/dsa-2720"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-59.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/60784"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-1890-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-1891-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=858101"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Mozilla project for reporting this issue. Upstream acknowledges moz_bug_r_a4 as the original reporter.", "affected_release": [{"advisory": "RHSA-2013:0982", "cpe": "cpe:/a:redhat:rhel_productivity:5", "package": "thunderbird-0:17.0.7-1.el5_9", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2013-06-25T00:00:00Z"}, {"advisory": "RHSA-2013:0981", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "firefox-0:17.0.7-1.el5_9", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2013-06-25T00:00:00Z"}, {"advisory": "RHSA-2013:0981", "cpe": "cpe:/o:redhat:enterprise_linux:5", "package": "xulrunner-0:17.0.7-1.el5_9", "product_name": "Red Hat Enterprise Linux 5", "release_date": "2013-06-25T00:00:00Z"}, {"advisory": "RHSA-2013:0981", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "firefox-0:17.0.7-1.el6_4", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2013-06-25T00:00:00Z"}, {"advisory": "RHSA-2013:0981", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "xulrunner-0:17.0.7-1.el6_4", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2013-06-25T00:00:00Z"}, {"advisory": "RHSA-2013:0982", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "thunderbird-0:17.0.7-1.el6_4", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2013-06-25T00:00:00Z"}], "bugzilla": {"description": "Mozilla: XrayWrappers can be bypassed to run user defined methods in a privileged context (MFSA 2013-59)", "id": "977614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=977614"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "status": "verified"}, "details": ["The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method."], "name": "CVE-2013-1697", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 5"}], "public_date": "2013-06-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2013-1697\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-1697\nhttp://www.mozilla.org/security/announce/2013/mfsa2013-59.html"], "threat_severity": "Moderate"}