CVE-2013-0757

high · 9.3

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.

9.3

CVSS

60.9%

EPSS (exploit prob.)

99th

EPSS percentile

2013-01-13

Published

AV:N/AC:M/Au:N/C:C/I:C/A:C

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
mozilla	firefox	< 17.0.2
mozilla	firefox	< 18.0
mozilla	seamonkey	< 2.15
mozilla	thunderbird	< 17.0.2
mozilla	thunderbird_esr	< 17.0.2
opensuse	opensuse	11.4
opensuse	opensuse	12.1
opensuse	opensuse	12.2
suse	linux_enterprise_desktop	10
suse	linux_enterprise_desktop	11
suse	linux_enterprise_server	10
suse	linux_enterprise_server	11
suse	linux_enterprise_server	11
suse	linux_enterprise_software_development_kit	10
suse	linux_enterprise_software_development_kit	11
canonical	ubuntu_linux	10.04
canonical	ubuntu_linux	11.10
canonical	ubuntu_linux	12.04
canonical	ubuntu_linux	12.10

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-0757