CVE-2013-0782

Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via unspecified vectors.

Published Bysecurity@mozilla.org

Published DateFeb 19, 2013, 23:55

Weakness Type (CWE):CWE-787

CVSS Metrics

Base Score

9.3

Vector String

AV:N/AC:M/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE

References

http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00017.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00062.html
http://rhn.redhat.com/errata/RHSA-2013-0271.html
http://rhn.redhat.com/errata/RHSA-2013-0272.html
http://www.debian.org/security/2013/dsa-2699
http://www.mozilla.org/security/announce/2013/mfsa2013-28.html
http://www.ubuntu.com/usn/USN-1729-1
http://www.ubuntu.com/usn/USN-1729-2
http://www.ubuntu.com/usn/USN-1748-1
https://bugzilla.mozilla.org/show_bug.cgi?id=827070
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16906

Weakness Type (CWE):CWE-787

CVSS Metrics

Base Score

9.3

Vector String

AV:N/AC:M/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE