Skip to content
OpenAdvisories
Unscored CVE-2013-5612 EUVD-2013-5452GHSA-f85h-xqx2-v9xg

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 makes it easier for remote attackers to i…

Published Dec 11, 2013 · Updated Aug 6, 2024 · Assigned by mozilla

Description

Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 26.0 and SeaMonkey before 2.23 makes it easier for remote attackers to inject arbitrary web script or HTML by leveraging a Same Origin Policy violation triggered by lack of a charset parameter in a Content-Type HTTP header.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 6 firefox +1 24.2.0-1.el6_5 RHSA-2013:1823, RHSA-2013:1812
RHEL 5 firefox 24.2.0-1.el5_10 RHSA-2013:1812
RHEL 5 thunderbird 24.2.0-2.el5_10 RHSA-2013:1823
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Productivity 5 thunderbird 24.2.0-2.el5_10 RHSA-2013:1823

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 50.1.0-1.1 openSUSE-SU-2024:10071-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 4

References