CVE-2013-1687 Information

Description

The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0 Firefox ESR 17.x before 17.0.7 Thunderbird before 17.0.7 and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions which allows remote attackers to execute arbitrary JavaScript code with chrome privileges or conduct cross-site scripting (XSS) attacks via a crafted web site.

Reference

http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html http://rhn.redhat.com/errata/RHSA-2013-0981.html http://rhn.redhat.com/errata/RHSA-2013-0982.html http://www.debian.org/security/2013/dsa-2716 http://www.debian.org/security/2013/dsa-2720 http://www.mozilla.org/security/announce/2013/mfsa2013-51.html http://www.securityfocus.com/bid/60777 http://www.ubuntu.com/usn/USN-1890-1 http://www.ubuntu.com/usn/USN-1891-1 https://bugzilla.mozilla.org/show_bug.cgi?id=863933 https://bugzilla.mozilla.org/show_bug.cgi?id=866823 https://oval.cisecurity.org/repository/search/definition/oval3Aorg.mitre.oval3Adef3A17117