CVE-2013-0796

critical

Published 2013-04-03 · Modified 2026-04-29

CVSS v3

—

CVSS v2

10.0

VIR risk

10.0

Description

The WebGL subsystem in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 on Linux does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a denial of service (free of unallocated memory) via unspecified vectors.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: security@mozilla.org — https://bugzilla.mozilla.org/show_bug.cgi?id=838413

vendor Authored 2026-05-27

Vendor advisory: security@mozilla.org — https://bugzilla.mozilla.org/show_bug.cgi?id=827106

vendor Authored 2026-05-27

Vendor advisory: security@mozilla.org — http://www.mozilla.org/security/announce/2013/mfsa2013-35.html

OS impact

OS	Version	Status	Fixed in
linux-kernel	-	not-affected

Application impact

Vendor	Product	Versions	Fixed
mozilla	firefox	`{"endExcluding":"20.0"}`	`20.0`
mozilla	thunderbird	`{"startIncluding":"17.0","endExcluding":"17.0.5"}`	`17.0.5`
mozilla	thunderbird_esr	`{"startIncluding":"17.0","endExcluding":"17.0.5"}`	`17.0.5`
mozilla	seamonkey	`{"endExcluding":"2.17"}`	`2.17`

References

Verify integrity in audit chain (admin only). AS-IS.