CVE-2013-1690
Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
Description
CVE-2013-1690 is a use-after-free vulnerability in Mozilla Firefox before version 22.0, Firefox ESR 17.x before 17.0.7, and Thunderbird before 17.0.7 that allows remote code execution through specially crafted web content. The flaw occurs in the handling of document elements during the DocumentViewerImpl::LastRefreshTime method, where freed memory can be reused by attacker-controlled data. With an EPSS score of 88.7% (99.5th percentile), this vulnerability has seen significant exploitation activity. CISA has added CVE-2013-1690 to the Known Exploited Vulnerabilities catalog.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| mozilla | firefox | < 22.0; >= 17.0, < 17.0.7 |
| mozilla | thunderbird | < 17.0.7 |
| mozilla | thunderbird esr | >= 17.0, < 17.0.7 |
| canonical | ubuntu linux | 12.04; 12.10; 13.04 |
| debian | debian linux | 7.0 |
| redhat | gluster storage server for on-premise | 2.0 |
| redhat | enterprise linux desktop | 5.0; 6.0 |
| redhat | enterprise linux eus | 5.9; 6.4 |
| redhat | enterprise linux server | 5.0; 6.0 |
| redhat | enterprise linux server aus | 5.9; 6.4 |
| redhat | enterprise linux workstation | 5.0; 6.0 |
| opensuse | opensuse | 11.4; 12.2; 12.3 |
| suse | linux enterprise desktop | 10; 11 |
| suse | linux enterprise server | 10; 11 |
| suse | linux enterprise software development kit | 10; 11 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html(Mailing List, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-0981.html(Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2013-0982.html(Third Party Advisory)
- http://www.debian.org/security/2013/dsa-2716(Mailing List, Third Party Advisory)
- http://www.debian.org/security/2013/dsa-2720(Mailing List, Third Party Advisory)
- http://www.mozilla.org/security/announce/2013/mfsa2013-53.html(Vendor Advisory)
- http://www.securityfocus.com/bid/60778(Broken Link, Third Party Advisory, VDB Entry)
- http://www.ubuntu.com/usn/USN-1890-1(Third Party Advisory)
- http://www.ubuntu.com/usn/USN-1891-1(Third Party Advisory)
- https://bugzilla.mozilla.org/show_bug.cgi?id=857883(Issue Tracking)
- https://bugzilla.mozilla.org/show_bug.cgi?id=901365(Issue Tracking)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996(Broken Link)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1690(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2013-1690 is a use-after-free vulnerability in Mozilla Firefox and Thunderbird's document rendering engine. The flaw occurs when the browser processes certain document elements that trigger memory deallocation during refresh operations, but the freed memory is subsequently accessed by the rendering pipeline, allowing an attacker to inject malicious data into the freed region.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2013-1690 has a CVSS v2 base score of 9.3, reflecting critical severity. The vulnerability requires no authentication and is exploitable remotely by luring a user to a malicious web page or embedding malicious content in an HTML email rendered by Thunderbird. Successful exploitation results in arbitrary code execution with the privileges of the current user. The EPSS score of 88.7% (99.5th percentile) confirms significant active exploitation. This vulnerability is particularly concerning because it affects both the Firefox web browser and the Thunderbird email client, expanding the potential attack surface to include email-based attack vectors.
Exploit Maturity
Public exploit code for CVE-2013-1690 has been available since its disclosure, and the vulnerability has been actively exploited in targeted attacks. CISA confirmed active exploitation by adding the vulnerability to the KEV catalog. The EPSS score of 88.7% (99.5th percentile) indicates substantial exploitation activity across the threat landscape, with the vulnerability having been leveraged in both opportunistic and targeted campaigns.
Remediation
- Update Mozilla Firefox to version 22.0 or later, and Firefox ESR to version 17.0.7 or later. Update Thunderbird to version 17.0.7 or later to address the use-after-free vulnerability.
- Enable automatic updates for Firefox and Thunderbird to ensure timely application of security patches for future vulnerabilities.
- Implement content security policies at the network level, including web content filtering and email attachment scanning, to reduce the risk of users encountering malicious content.
- Configure Thunderbird to display emails in plain text where possible to mitigate HTML-based exploitation vectors targeting the email client.
- Deploy endpoint detection and response (EDR) solutions to detect and contain exploitation attempts that may target unpatched browser and email client installations.
Technical Details
CVE-2013-1690 is a use-after-free vulnerability (CWE-416) in the document rendering engine shared by Mozilla Firefox and Thunderbird. The flaw is triggered during the DocumentViewerImpl::LastRefreshTime method, where a race condition or improper lifecycle management causes a document element to be freed while still referenced by the rendering pipeline. An attacker can craft HTML content that triggers this specific code path, causing the browser to access freed memory that has been overwritten with attacker-controlled data. This enables control of the instruction pointer and subsequent arbitrary code execution. The vulnerability affects both browser-based and email-based rendering contexts, as Thunderbird uses the same Gecko rendering engine as Firefox.
Frequently Asked Questions
Is CVE-2013-1690 being actively exploited?
Yes, CVE-2013-1690 has been actively exploited in the wild. CISA confirmed this by adding the vulnerability to the Known Exploited Vulnerabilities catalog. The EPSS score of 88.7% (99.5th percentile) reflects significant exploitation activity.
What products are affected by CVE-2013-1690?
Mozilla Firefox before version 22.0, Firefox ESR 17.x before 17.0.7, and Thunderbird before 17.0.7 are affected. All three products share the same vulnerable Gecko rendering engine component.
How do I fix CVE-2013-1690?
Update Firefox to version 22.0 or later, Firefox ESR to 17.0.7 or later, and Thunderbird to 17.0.7 or later. Enable automatic updates to receive future security patches promptly.
How severe is CVE-2013-1690?
CVE-2013-1690 has a CVSS v2 score of 9.3 (Critical) and enables remote code execution through malicious web content or HTML emails. The EPSS score of 88.7% confirms high exploitation activity, and the dual attack surface through both browser and email client makes it particularly dangerous.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.