CVE-2013-0757: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2013-0757 is a high (CVSS 9.3) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 60.86% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 4 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 13-01-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
60.86%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 60.86% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (bugzilla.mozilla.org)
Maturity: unknown
Mozilla Firefox < 17.0.1 - Flash Privileged Code Injection (Metasploit)
Maturity: weaponized
GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit)
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Mozilla4 products
- firefox< 17.0.2 | < 18.0
- seamonkey< 2.15
- thunderbird< 17.0.2
- thunderbird_esr< 17.0.2
Suse3 products
- linux_enterprise_desktop10:sp4 | 11:sp2
- linux_enterprise_server10:sp4 | 11:sp2
- linux_enterprise_software_development_kit10:sp4 | 11:sp2
Canonical1 product
- ubuntu_linuxEOL10.04 | 11.10 | 12.04 | 12.10
Opensuse1 product
- opensuseEOL11.4 | 12.1 | 12.2
4 vendors · 9 products
References
10 links- lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16939VDB EntrySignatureX Refsource OVALThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- bugzilla.mozilla.org/show_bug.cgi?id=813901X Refsource CONFIRMExploitIssue TrackingPatchVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory