Vulnerabilities
Misconfiguration
Runtime Security
Compliance
CVE Vulnerabilities

CVE-2013-1675

Improper Initialization

Published: May 16, 2013 | Modified: Dec 20, 2024
CVSS 3.x
6.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V2
6.8 CRITICAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
RedHat/V3
Ubuntu
MEDIUM
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2013-1675
CWEhttps://cwe.mitre.org/data/definitions/665.html

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Weakness

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

Affected Software

Name Vendor Start Version End Version
Firefox Mozilla * 21.0 (excluding)
Firefox Mozilla 17.0 (including) 17.0.6 (excluding)
Thunderbird Mozilla * 17.0.6 (excluding)
Thunderbird_esr Mozilla 17.0 (including) 17.0.6 (excluding)
Red Hat Enterprise Linux 5 RedHat thunderbird-0:17.0.6-1.el5_9 *
Red Hat Enterprise Linux 5 RedHat firefox-0:17.0.6-1.el5_9 *
Red Hat Enterprise Linux 5 RedHat xulrunner-0:17.0.6-1.el5_9 *
Red Hat Enterprise Linux 6 RedHat firefox-0:17.0.6-1.el6_4 *
Red Hat Enterprise Linux 6 RedHat xulrunner-0:17.0.6-2.el6_4 *
Red Hat Enterprise Linux 6 RedHat thunderbird-0:17.0.6-2.el6_4 *
Firefox Ubuntu devel *
Firefox Ubuntu lucid *
Firefox Ubuntu precise *
Firefox Ubuntu quantal *
Firefox Ubuntu raring *
Firefox Ubuntu upstream *
Seamonkey Ubuntu lucid *
Thunderbird Ubuntu devel *
Thunderbird Ubuntu lucid *
Thunderbird Ubuntu precise *
Thunderbird Ubuntu quantal *
Thunderbird Ubuntu raring *
Thunderbird Ubuntu upstream *
Xulrunner-1.9.2 Ubuntu lucid *

Potential Mitigations

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable’s type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2024 Aqua Security Software Ltd.   Privacy Policy | Terms of Use