Published: 30/10/2013 Updated: 19/09/2017

CVSS v2 Base Score: 8.3 | Impact Score: 8.5 | Exploitability Score: 8.6

VMScore: 739

Vector: AV:N/AC:M/Au:N/C:C/I:P/A:P

PDF.js in Mozilla Firefox prior to 25.0 and Firefox ESR 24.x prior to 24.1 does not properly handle the appending of an IFRAME element, which allows remote malicious users to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.

Vulnerable Product	Search on Vulmon	Subscribe to Product
mozilla firefox esr 24.0.1
mozilla firefox esr 24.0.2
mozilla firefox esr 24.0
mozilla firefox 21.0
mozilla firefox 20.0.1
mozilla firefox 19.0.2
mozilla firefox 19.0.1
mozilla firefox 23.0
mozilla firefox 19.0
mozilla firefox 22.0
mozilla firefox
mozilla firefox 20.0
mozilla firefox 23.0.1

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Mozilla Foundation Security Advisory 2013-99 Security bypass of PDFjs checks using iframes Announced October 29, 2013 Reporter Cody Crews Impact High Products Firefox, Firefox ESR Fixed in ...

CWE-264 https://bugzilla.mozilla.org/show_bug.cgi?id=920515 http://www.mozilla.org/security/announce/2013/mfsa2013-99.html http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html https://security.gentoo.org/glsa/201504-01 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19133 https://usn.ubuntu.com/2009-1/https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2013-5598

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect