← Vulnerability Intelligence

CVE-2013-1690

High 8.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply updates per vendor instructions.

Description

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

Metrics

CVSS 3.1
8.8 (HIGH) Score source: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS — exploit probability
69% (percentile: 99) as of 1 November 2026
CWE
CWE-119

Affected products

mozilla: firefox; mozilla: thunderbird; mozilla: thunderbird esr; canonical: ubuntu linux; debian: debian linux; redhat: gluster storage server for on-premise; redhat: enterprise linux desktop; redhat: enterprise linux eus; redhat: enterprise linux server; redhat: enterprise linux server aus; redhat: enterprise linux workstation; opensuse: opensuse; suse: linux enterprise desktop; suse: linux enterprise server; suse: linux enterprise software development kit

References