Lucene search
Mozilla FoundationMFSA2013-99HistoryOct 29, 2013 - 12:00 a.m.
Security bypass of PDF.js checks using iframes — Mozilla
2013-10-2900:00:00
Mozilla Foundation
www.mozilla.org
29
CVSS2
8.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:C/I:P/A:P
EPSS
0.011
Percentile
84.8%
Security researcher Cody Crews discovered a method to append an iframe into an embedded PDF object rendered with the chrome privileged PDF.js. This can used to bypass security restrictions to load local or chrome privileged files and objects within the embedded PDF object. This can lead to information disclosure of local system files.
Affected configurations
Node
mozillafirefoxRange<25
ORmozillafirefox_esrRange<24.1
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mozilla | firefox | * | cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | firefox_esr | * | cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:* |
Related
openvas
openvas
Mozilla Firefox Security Advisory (MFSA2013-99) - Linux
2021-11-11 00:00:00
Mozilla Firefox ESR Multiple Vulnerabilities-01 (Nov 2013) - Mac OS X
2013-11-07 00:00:00
Mozilla Firefox ESR Multiple Vulnerabilities-01 (Nov 2013) - Windows
2013-11-07 00:00:00
ubuntucve
ubuntucve
CVE-2013-5598
2013-10-29 00:00:00
cve
cve
CVE-2013-5598
2013-10-30 10:55:04
nvd
nvd
CVE-2013-5598
2013-10-30 10:55:04
prion
prion
Code injection
2013-10-30 10:55:00
cvelist
cvelist
CVE-2013-5598
2013-10-30 10:00:00
suse
suse
Mozilla updates 10/2013 (important)
2013-11-07 11:04:15
Mozilla Suite: Update to October 2013 release (important)
2013-11-07 10:04:11
nessus
nessus
openSUSE Security Update : seamonkey (openSUSE-SU-2013:1788-1)
2014-06-13 00:00:00
openSUSE Security Update : seamonkey (openSUSE-SU-2013:1644-1)
2014-06-13 00:00:00
freebsd
freebsd
mozilla -- multiple vulnerabilities
2013-10-29 00:00:00
securityvulns
securityvulns
Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities
2013-11-05 00:00:00
ubuntu
ubuntu
Firefox vulnerabilities
2013-10-29 00:00:00
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2015-04-07 00:00:00
osv
osv
MozillaFirefox-50.1.0-1.1 on GA media
2024-06-15 00:00:00
CVSS2
8.3
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:C/I:P/A:P
EPSS
0.011
Percentile
84.8%
Related for MFSA2013-99