製品・ソフトウェアに関する情報

JVN脆弱性詳細

Mozilla Firefox および Thunderbird におけるサービス運用妨害 (DoS) の脆弱性

Title	Mozilla Firefox および Thunderbird におけるサービス運用妨害 (DoS) の脆弱性
Summary	Mozilla Firefox および Thunderbird は、ページの再読み込みに関連した onreadystatechange イベントを適切に処理しないため、サービス運用妨害 (アプリケーションクラッシュ) 状態にされる、または任意のコードを実行される脆弱性が存在します。
Possible impacts	第三者により、マッピングされていないメモリロケーションでのデータの実行を誘発する巧妙に細工された Web サイトを介して、サービス運用妨害 (アプリケーションクラッシュ) 状態にされる、または任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 25, 2013, midnight
Registration Date	June 27, 2013, 3:56 p.m.
Last Update	Aug. 14, 2013, 4:37 p.m.

CVSS2.0 : 危険
Score	9.3
Vector	AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected System

Mozilla Foundation

Mozilla Firefox 22.0 未満

Mozilla Firefox ESR 17.0.7 未満

Mozilla Thunderbird 17.0.7 未満

Mozilla Thunderbird ESR 17.0.7 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-1690	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1690
National Vulnerability Database (NVD)
2	CVE-2013-1690	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1690

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-2716	http://www.debian.org/security/2013/dsa-2716
Mozilla Bugzilla
2	Bug 901365	https://bugzilla.mozilla.org/show_bug.cgi?id=901365
Mozilla Foundation Security Advisory
3	MFSA2013-53	http://www.mozilla.org/security/announce/2013/mfsa2013-53.html
Mozilla Foundation セキュリティアドバイザリ
4	MFSA2013-53	http://www.mozilla-japan.org/security/announce/2013/mfsa2013-53.html
opensuse-security-announce
5	SUSE-SU-2013:1152	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html
Red Hat Security Advisory
6	RHSA-2013:0981	http://rhn.redhat.com/errata/RHSA-2013-0981.html
7	RHSA-2013:0982	http://rhn.redhat.com/errata/RHSA-2013-0982.html
Ubuntu Security Notice
8	USN-1890-1	http://www.ubuntu.com/usn/USN-1890-1/
9	USN-1891-1	http://www.ubuntu.com/usn/USN-1891-1

Change Log

No	Changed Details	Date of change
0	[2013年06月27日] 掲載 [2013年07月05日] ベンダ情報：Ubuntu (USN-1890-1) を追加ベンダ情報：Ubuntu (USN-1891-1) を追加ベンダ情報：レッドハット (RHSA-2013:0981) を追加ベンダ情報：レッドハット (RHSA-2013:0982) を追加ベンダ情報：Debian (DSA-2716) を追加 [2013年08月14日] ベンダ情報：Mozilla Foundation (Bug 901365) を追加ベンダ情報：openSUSE (SUSE-SU-2013:1152) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2013-1690

Summary	Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
Publication Date	June 26, 2013, 12:19 p.m.
Registration Date	Jan. 26, 2021, 3:36 p.m.
Last Update	Nov. 21, 2024, 10:50 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:mozilla:thunderbird_esr::::::::	17.0			17.0.7
cpe:2.3:a:mozilla:thunderbird::::::::				17.0.7
cpe:2.3:a:mozilla:firefox::::::::				22.0
cpe:2.3:a:mozilla:firefox::::::::	17.0			17.0.7

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:13.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:7.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:5.9:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:6.4:::::::*
cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::vmware::*
cpe:2.3:o:opensuse:opensuse:12.3:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3::::::
cpe:2.3:o:opensuse:opensuse:11.4:::::::*
cpe:2.3:o:opensuse:opensuse:12.2:::::::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::vmware::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::-::*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::-::*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:::-:::*
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:::-:::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:::ltss:vmware::
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:::ltss:-::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html	Mailing List Third Party Advisory
9	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html	Mailing List Third Party Advisory
10	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html	Mailing List Third Party Advisory
11	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html	Mailing List Third Party Advisory
12	http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html	Mailing List Third Party Advisory
13	http://rhn.redhat.com/errata/RHSA-2013-0981.html	Third Party Advisory
14	http://rhn.redhat.com/errata/RHSA-2013-0981.html	Third Party Advisory
15	http://rhn.redhat.com/errata/RHSA-2013-0982.html	Third Party Advisory
16	http://rhn.redhat.com/errata/RHSA-2013-0982.html	Third Party Advisory
17	http://www.debian.org/security/2013/dsa-2716	Mailing List Third Party Advisory
18	http://www.debian.org/security/2013/dsa-2716	Mailing List Third Party Advisory
19	http://www.debian.org/security/2013/dsa-2720	Mailing List Third Party Advisory
20	http://www.debian.org/security/2013/dsa-2720	Mailing List Third Party Advisory
21	http://www.mozilla.org/security/announce/2013/mfsa2013-53.html	Vendor Advisory
22	http://www.mozilla.org/security/announce/2013/mfsa2013-53.html	Vendor Advisory
23	http://www.securityfocus.com/bid/60778	Broken Link Third Party Advisory VDB Entry
24	http://www.securityfocus.com/bid/60778	Broken Link Third Party Advisory VDB Entry
25	http://www.ubuntu.com/usn/USN-1890-1	Third Party Advisory
26	http://www.ubuntu.com/usn/USN-1890-1	Third Party Advisory
27	http://www.ubuntu.com/usn/USN-1891-1	Third Party Advisory
28	http://www.ubuntu.com/usn/USN-1891-1	Third Party Advisory
29	https://bugzilla.mozilla.org/show_bug.cgi?id=857883	Issue Tracking
30	https://bugzilla.mozilla.org/show_bug.cgi?id=857883	Issue Tracking
31	https://bugzilla.mozilla.org/show_bug.cgi?id=901365	Issue Tracking
32	https://bugzilla.mozilla.org/show_bug.cgi?id=901365	Issue Tracking
33	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996	Broken Link
34	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996	Broken Link

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:5.9:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:5.9:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:6.4:::::::*
cpe:2.3:a:redhat:gluster_storage_server_for_on-premise:2.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::vmware::*
cpe:2.3:o:opensuse:opensuse:12.3:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2::::::
cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp3::::::
cpe:2.3:o:opensuse:opensuse:11.4:::::::*
cpe:2.3:o:opensuse:opensuse:12.2:::::::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::vmware::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2::::-::*
cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4::::::
cpe:2.3:o:suse:linux_enterprise_server:11:sp3::::-::*
cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:::-:::*
cpe:2.3:o:suse:linux_enterprise_server:10:sp4:::-:::*
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:::ltss:vmware::
cpe:2.3:o:suse:linux_enterprise_server:11:sp1:::ltss:-::