CVE-2013-5609
Description
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: security@mozilla.org — https://bugzilla.mozilla.org/show_bug.cgi?id=937582
Vendor advisory: security@mozilla.org — https://bugzilla.mozilla.org/show_bug.cgi?id=922009
Vendor advisory: security@mozilla.org — https://bugzilla.mozilla.org/show_bug.cgi?id=905382
Vendor advisory: security@mozilla.org — https://bugzilla.mozilla.org/show_bug.cgi?id=886850
Vendor advisory: security@mozilla.org — http://www.mozilla.org/security/announce/2013/mfsa2013-104.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| fedora | 18 | affected | |
| fedora | 19 | affected | |
| fedora | 20 | affected | |
| suse | 12.2 | affected | |
| suse | 12.3 | affected | |
| suse | 13.1 | affected | |
| suse | 11 | affected | |
| ubuntu | 12.04 | affected | |
| ubuntu | 12.10 | affected | |
| ubuntu | 13.04 | affected | |
| ubuntu | 13.10 | affected | |
| rhel | 5.0 | affected | |
| rhel | 6.0 | affected | |
| rhel | 6.5 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| mozilla | firefox | {"endExcluding":"26.0"} | 26.0 |
| mozilla | seamonkey | {"endExcluding":"2.23"} | 2.23 |
| mozilla | thunderbird | {"endExcluding":"24.2"} | 24.2 |
| suse | suse_linux_enterprise_software_development_kit | 11.0 | |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html
- http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00010.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html
- http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html
- http://rhn.redhat.com/errata/RHSA-2013-1812.html
- http://www.mozilla.org/security/announce/2013/mfsa2013-104.html
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.securitytracker.com/id/1029470
- http://www.securitytracker.com/id/1029476
- http://www.ubuntu.com/usn/USN-2052-1
- http://www.ubuntu.com/usn/USN-2053-1
- https://bugzilla.mozilla.org/show_bug.cgi?id=886850
- https://bugzilla.mozilla.org/show_bug.cgi?id=905382
- https://bugzilla.mozilla.org/show_bug.cgi?id=922009
- https://bugzilla.mozilla.org/show_bug.cgi?id=937582
- https://security.gentoo.org/glsa/201504-01
- http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html
Verify integrity in audit chain (admin only). AS-IS.