Description
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | icedove | 17.0.7-1~deb7u1 | DSA-2720-1 |
| Debian 7 | iceweasel | 17.0.7esr-1~deb7u1 | DSA-2716-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | firefox +3 | 17.0.7-1.el6_4 | RHSA-2013:0982, RHSA-2013:0981 |
| RHEL 5 | firefox +2 | 17.0.7-1.el5_9 | RHSA-2013:0981 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Productivity 5 | thunderbird | 17.0.7-1.el5_9 | RHSA-2013:0982 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 | openSUSE-SU-2024:10071-1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 | openSUSE-SU-2024:10230-1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 | openSUSE-SU-2024:14572-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Firefox onreadystatechange Event DocumentViewerImpl Use After Free
exploit/windows/browser/mozilla_firefox_onreadystatechange
Exploit-DB 1
- Mozilla Firefox - onreadystatechange Event DocumentViewerImpl Use-After-Free (Metasploit) EDB-27429 · remote · Aug 8, 2013 · verified
GitHub 2 repositories
-
vlad902/annotated-fbi-tbb-exploit ★ 15 · Aug 19, 2014
Annotated FBI exploit for the Tor Browser Bundle from mid-2013 (CVE-2013-1690)
-
Diamond975-py/FBI-Tor-Exploit-CVE-2013-1690 ★ 0 · Oct 29, 2026
Academic cybersecurity research project analyzing and restoring the FBI's 2013 Tor Browser deanonymization exploit, focusing on CVE-2013-1690, Firefox use-after-free vulnerabilities, exploit mechanis…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 7
- RHSA-2013:0982 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2013:0981 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2716-1 iceweasel - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2720-1 icedove - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10230-1 MozillaThunderbird-45.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14572-1 firefox-esr-128.5.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10071-1 MozillaFirefox-50.1.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- USN-1890-1 vendor-advisory
- RHSA-2013:0982 vendor-advisory
- SUSE-SU-2013:1153 vendor-advisory
- SUSE-SU-2013:1152 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=857883
- http://www.mozilla.org/security/announce/2013/mfsa2013-53.html
- RHSA-2013:0981 vendor-advisory
- USN-1891-1 vendor-advisory
- openSUSE-SU-2013:1141 vendor-advisory
- DSA-2716 vendor-advisory
- oval:org.mitre.oval:def:16996 vdb-entry signature
- openSUSE-SU-2013:1142 vendor-advisory
- openSUSE-SU-2013:1140 vendor-advisory
- DSA-2720 vendor-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=901365
- 60778 vdb-entry
- openSUSE-SU-2013:1143 vendor-advisory