CVE

Id
65543  
CVE No.
CVE-2013-5596  
Status
Candidate  
Description
The cycle collection (CC) implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly determine the thread for release of an image object, which allows remote attackers to execute arbitrary code or cause a denial of service (race condition and application crash) via a large HTML document containing IMG elements, as demonstrated by the Never-Ending Reddit on reddit.com.  
Phase
Assigned (20130826)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
639364 65543 CVE-2013-5596 CONFIRM:http://www.mozilla.org/security/announce/2013/mfsa2013-97.html  View
639365 65543 CVE-2013-5596 CONFIRM:https://bugzilla.mozilla.org/show_bug.cgi?id=910881  View
639366 65543 CVE-2013-5596 GENTOO:GLSA-201504-01  View
639367 65543 CVE-2013-5596 URL:https://security.gentoo.org/glsa/201504-01  View
639368 65543 CVE-2013-5596 SUSE:openSUSE-SU-2013:1634  View
639369 65543 CVE-2013-5596 URL:http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html  View
639370 65543 CVE-2013-5596 SUSE:openSUSE-SU-2013:1633  View
639371 65543 CVE-2013-5596 URL:http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html  View
639372 65543 CVE-2013-5596 OVAL:oval:org.mitre.oval:def:19066  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
23379 JVNDB-2013-004954 複数の Mozilla 製品における任意のコードを実行される脆弱性 Mozilla Firefox、Thunderbird、および SeaMonkey の nsEventListenerManager::SetEventHandler 関数には、ガーベジコレクション (GC) API を使用したメモリ割り当てに関する処理に不備があるため、解放済みメモリの使用 (Use-after-free) により、任意のコードを実行される脆弱性が存在します。 CVE-2013-5601 65543 10 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-004954.html  View