CVE-2013-1690

KEVMozilla Firefox and Thunderbird Denial-of-Service Vulnerability

Description

Mozilla Firefox and Thunderbird do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial-of-service (DoS) or possibly execute malicious code via a crafted web site.

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

PublishedJun 26, 2013

Last modifiedJun 16, 2026

Added to KEVMar 28, 2022

Remediation dueApr 18, 2022

References

lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.htmlMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-0981.htmlThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-0982.htmlThird Party Advisory
debian.org/security/2013/dsa-2716Mailing ListThird Party Advisory
debian.org/security/2013/dsa-2720Mailing ListThird Party Advisory
mozilla.org/security/announce/2013/mfsa2013-53.htmlVendor Advisory
securityfocus.com/bid/60778Broken LinkThird Party Advisory

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1653 days
CVSS: 8.8 HIGH
EPSS (30-day exploit probability): 69.0% · top 1% of all CVEs
Weakness: CWE-119
Attack vector: Network, remotely reachable

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.