CVE-2013-1675

KEVMozilla Firefox Information Disclosure Vulnerability

Description

Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

PublishedMay 16, 2013

Last modifiedJun 16, 2026

Added to KEVMar 3, 2022

Remediation dueMar 24, 2022

References

lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.htmlMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-0820.htmlThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-0821.htmlThird Party Advisory
debian.org/security/2013/dsa-2699Mailing List
mandriva.com/security/advisories?name=MDVSA-2013:165Broken Link
mozilla.org/security/announce/2013/mfsa2013-47.htmlVendor Advisory
securityfocus.com/bid/59858Broken LinkThird Party Advisory
ubuntu.com/usn/USN-1822-1Third Party Advisory

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1678 days
CVSS: 6.5 MEDIUM
EPSS (30-day exploit probability): 6.7% · top 6% of all CVEs
Weakness: CWE-665
Attack vector: Network, remotely reachable

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.