CVE-2013-1675
Mozilla Firefox Information Disclosure Vulnerability
Description
CVE-2013-1675 is a MEDIUM vulnerability in Mozilla Firefox, carrying a CVSS 3.1 score of 6.5. Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. The flaw is classified under CWE-665 (Improper Initialization). In a typical attack scenario, an attacker would host a specially crafted web page or deliver a malicious link via phishing, and exploitation occurs when the victim navigates to the attacker-controlled content using the vulnerable browser. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-03-24. With an EPSS score of 0.04742 (89.27th percentile), this vulnerability exhibits substantial real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | < 21.0; >= 17.0, < 17.0.6 |
| mozilla | thunderbird | < 17.0.6 |
| mozilla | thunderbird esr | >= 17.0, < 17.0.6 |
| canonical | ubuntu linux | 12.04; 12.10; 13.04 |
| debian | debian linux | 7.0 |
| redhat | gluster storage server for on-premise | 2.1 |
| redhat | enterprise linux desktop | 5.0; 6.0 |
| redhat | enterprise linux eus | 5.9; 6.4 |
| redhat | enterprise linux for ibm z systems | 5.0_s390x; 6.0_s390x |
| redhat | enterprise linux for ibm z systems eus | 5.9_s390x; 6.4_s390x |
| redhat | enterprise linux for power big endian | 5.0_ppc; 6.0_ppc64 |
| redhat | enterprise linux for power big endian eus | 5.9_ppc; 6.4_ppc64 |
| redhat | enterprise linux for scientific computing | 6.0 |
| redhat | enterprise linux server | 5.0; 6.0 |
| redhat | enterprise linux server aus | 5.9; 6.4 |
| redhat | enterprise linux server eus from rhui | 5.9; 6.4 |
| redhat | enterprise linux workstation | 5.0; 6.0 |
| opensuse | opensuse | 12.2; 12.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html(Mailing List, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-0820.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-0821.html(Third Party Advisory)
- http://www.debian.org/security/2013/dsa-2699(Mailing List)
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:165(Broken Link)
- http://www.mozilla.org/security/announce/2013/mfsa2013-47.html(Vendor Advisory)
- http://www.securityfocus.com/bid/59858(Broken Link, Third Party Advisory, VDB Entry)
- http://www.ubuntu.com/usn/USN-1822-1(Third Party Advisory)
- http://www.ubuntu.com/usn/USN-1823-1(Third Party Advisory)
- https://bugzilla.mozilla.org/show_bug.cgi?id=866825(Exploit, Issue Tracking)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1675(US Government Resource)
Weakness Type
CWE-665: Improper Initialization
CVE-2013-1675 is classified under CWE-665 — Improper Initialization. Improper Initialization occurs when an application does not properly initialize critical variables, data structures, or resources before use. This includes failing to initialize memory allocations, not setting default values for security-critical variables, partially initializing data structures, or relying on undefined initial values. The resulting undefined or attacker-controlled values can lead to security vulnerabilities.
In the context of Mozilla Firefox, this weakness class is particularly concerning because the product is widely deployed across enterprise and consumer environments. Security-critical flags may default to "allowed" state. Uninitialized pointers cause crashes or arbitrary memory access. Sensitive data from previous operations exposed in memory. Authentication variables may bypass checks if not properly initialized. Cryptographic keys may be weak or predictable. Buffer contents may leak information to attackers. Organizations using affected versions should understand that this weakness class frequently enables reliable exploitation paths that threat actors actively leverage in both targeted and opportunistic attacks.
Impact Analysis
CVE-2013-1675 carries a CVSS 3.1 score of 6.5 (MEDIUM) with the following impact characteristics.
Confidentiality (HIGH): An attacker who successfully exploits this vulnerability gains access to all data accessible by the affected component. In the context of Mozilla Firefox, this can include sensitive configuration data, user credentials, proprietary business information, and any data the application processes or stores.
Integrity (NONE): No direct impact on data integrity has been identified.
Availability (NONE): No direct impact on system availability has been identified.
Scope (Unchanged): The exploitation impact is contained within the security scope of the vulnerable component itself. While the damage within that scope can be severe with full compromise of the affected application, lateral impact on other systems requires additional exploitation steps.
With an EPSS score of 0.04742 (89.27th percentile), this vulnerability ranks among the most likely to be exploited in the wild, placing it well above the vast majority of all cataloged vulnerabilities in terms of real-world exploitation activity.
Exploit Maturity
CVE-2013-1675 demonstrates significant exploit maturity with confirmed active exploitation in the wild.
Active exploitation: This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming that it has been observed being actively exploited by threat actors. The KEV designation mandates federal agencies to apply remediation within a defined timeframe and serves as a strong signal of real-world risk.
Ransomware association: As of the current KEV catalog data, no direct ransomware association has been confirmed for CVE-2013-1675. However, the vulnerability's characteristics and confirmed exploitation in the wild mean it remains a viable vector for various threat actors including cybercriminals and advanced persistent threat groups.
Public exploits: Public exploit code is available, significantly lowering the barrier for exploitation. Known exploit references include entries on Exploit-DB. The availability of weaponized code means that both sophisticated threat actors and less-skilled attackers can target this vulnerability with minimal development effort.
KEV remediation deadline: CISA set a remediation deadline of 2022-03-24 for federal agencies, underscoring the urgency of patching. Organizations beyond the federal sector should treat this deadline as a strong indicator of the risk level and prioritize remediation accordingly.
Remediation
-
Apply vendor-provided security patches immediately. Apply updates per vendor instructions. Consult the official security advisory for specific patch versions and deployment guidance.
-
Verify affected product versions in your environment. Affected products include: Firefox (< 21.0; >= 17.0, < 17.0.6), Thunderbird (< 17.0.6), Thunderbird Esr (>= 17.0, < 17.0.6), Ubuntu Linux (12.04; 12.10; 13.04), Debian Linux (7.0), Gluster Storage Server For On-premise (2.1), Enterprise Linux Desktop (5.0; 6.0), Enterprise Linux Eus (5.9; 6.4), Enterprise Linux For Ibm Z Systems (5.0_s390x; 6.0_s390x), Enterprise Linux For Ibm Z Systems Eus (5.9_s390x; 6.4_s390x), Enterprise Linux For Power Big Endian (5.0_ppc; 6.0_ppc64), Enterprise Linux For Power Big Endian Eus (5.9_ppc; 6.4_ppc64), Enterprise Linux For Scientific Computing (6.0), Enterprise Linux Server (5.0; 6.0), Enterprise Linux Server Aus (5.9; 6.4), Enterprise Linux Server Eus From Rhui (5.9; 6.4), Enterprise Linux Workstation (5.0; 6.0), Opensuse (12.2; 12.3). Conduct an inventory of all instances across your organization to ensure comprehensive patch coverage and prevent any unpatched systems from remaining exposed.
-
Implement interim mitigations if immediate patching is not feasible. Restrict network access to the affected service using firewall rules and access control lists. Limit exposure to trusted networks only and monitor for suspicious network traffic patterns targeting the vulnerable service.
-
Enable enhanced monitoring and detection. Configure intrusion detection systems and endpoint detection and response (EDR) tools to detect exploitation attempts targeting CVE-2013-1675. Review security logs for indicators of compromise and establish alerting for anomalous behavior on systems running affected software.
-
Conduct a post-patch vulnerability assessment. After applying patches, verify that the remediation was effective by running vulnerability scans against all previously affected systems. Confirm the vulnerability is no longer present and ensure no instances were missed during deployment.
-
Review and update incident response procedures. Ensure your incident response plan accounts for potential exploitation of CVE-2013-1675. Document patching status and maintain evidence of remediation for compliance and audit purposes.
Technical Details
CVE-2013-1675 is a medium-severity vulnerability affecting Mozilla Firefox. Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
Attack Vector: The attack vector is NETWORK, meaning the vulnerability can be exploited remotely over the network without requiring the attacker to have local access to the target system. This significantly expands the potential attacker population and makes the vulnerability accessible to remote threat actors.
Attack Complexity: The attack complexity is LOW. Exploitation does not require specialized conditions, race conditions, or extensive preparation — making it accessible to a broad range of attackers including those with limited technical sophistication.
Prerequisites: No prior privileges are required. User interaction is required, typically involving a victim opening a specially crafted file, clicking a malicious link, or visiting a compromised website.
Underlying mechanism: The vulnerability stems from improper initialization, where improper initialization occurs when an application does not properly initialize critical variables, data structures, or resources before use. In the context of Firefox, this manifests when processing specially crafted input that triggers the underlying memory corruption or logic flaw, allowing the attacker to achieve code execution or other malicious outcomes.
Affected products: Firefox (< 21.0; >= 17.0, < 17.0.6), Thunderbird (< 17.0.6), Thunderbird Esr (>= 17.0, < 17.0.6), Ubuntu Linux (12.04; 12.10; 13.04), Debian Linux (7.0), Gluster Storage Server For On-premise (2.1), Enterprise Linux Desktop (5.0; 6.0), Enterprise Linux Eus (5.9; 6.4), Enterprise Linux For Ibm Z Systems (5.0_s390x; 6.0_s390x), Enterprise Linux For Ibm Z Systems Eus (5.9_s390x; 6.4_s390x), Enterprise Linux For Power Big Endian (5.0_ppc; 6.0_ppc64), Enterprise Linux For Power Big Endian Eus (5.9_ppc; 6.4_ppc64), Enterprise Linux For Scientific Computing (6.0), Enterprise Linux Server (5.0; 6.0), Enterprise Linux Server Aus (5.9; 6.4), Enterprise Linux Server Eus From Rhui (5.9; 6.4), Enterprise Linux Workstation (5.0; 6.0), Opensuse (12.2; 12.3). Organizations should cross-reference their deployed versions against this list to assess their exposure to this vulnerability.
Frequently Asked Questions
What is CVE-2013-1675?
CVE-2013-1675 is a medium-severity vulnerability (CVSS 6.5) affecting Mozilla Firefox. Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. It is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.
Which products are affected by CVE-2013-1675?
The vulnerability affects Mozilla products including Firefox, Thunderbird, Thunderbird Esr. Affected versions include < 21.0; >= 17.0, < 17.0.6. Organizations should consult the vendor's security advisory for the complete list of affected versions and available patches.
How do I fix CVE-2013-1675?
Apply updates per vendor instructions. Refer to the official vendor security advisory for specific patch downloads and deployment instructions. If immediate patching is not possible, implement interim mitigations such as restricting access to the vulnerable component, enabling enhanced monitoring, and educating users about potential attack vectors. Verify remediation effectiveness with post-patch vulnerability scanning.
How severe is CVE-2013-1675?
CVE-2013-1675 is rated MEDIUM with a CVSS 3.1 score of 6.5. Its EPSS score of 0.04742 places it in the 89.27th percentile for exploitation likelihood, meaning it is more likely to be exploited than 89.3% of all known vulnerabilities. The KEV remediation deadline was 2022-03-24, and the vulnerability's confirmed active exploitation makes it a high-priority remediation target. Organizations should treat patching as urgent regardless of whether they believe they are currently targeted.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.