Every CVE Search/ Get API key

CVE-2013-1705

Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox...

10.0 High

Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Certificate Request Message Format (CRMF) request.

Exploit likelihood

3.91%Down 0.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Certificate Request Message Format (CRMF) request.

Record
CVE-2013-1705
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Certificate Request Message Format (CRMF) request.

Record
CVE-2013-1705
Updated
2026-11-02
EUVDEUVD-2013-1732 No score

Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Certificate Request Message Format (CRMF) request.

Record
EUVD-2013-1732
Updated
2026-11-03
GitHub AdvisoriesGHSA-3p9p-84c4-78r8 No score

Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox...

Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Certificate Request Message Format (CRMF) request.

Record
GHSA-3p9p-84c4-78r8
Weakness
CWE-119
Updated
2026-11-02
OSVMGASA-2013-0329 No score

Updated iceape packages fix many vulnerabilities

Updated iceape packages fix security issues:

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2013-1682)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2013-1683)

Use-after-free vulnerability in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site. (CVE-2013-1684)

Use-after-free vulnerability in the nsIDocument::GetRootElement function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site. (CVE-2013-1685)

Use-after-free vulnerability in the mozilla::ResetDir function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2013-1686)

The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site. (CVE-2013-1687)

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location. (CVE-2013-1690)

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web site. (CVE-2013-1692)

The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly bypass the Same Origin Policy and read text from a different domain, by observing timing differences in execution of filter code. (CVE-2013-1693)

The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag. (CVE-2013-1694)

Mozilla Firefox before 22.0 does not properly implement certain DocShell inheritance behavior for the sandbox attribute of an IFRAME element, which allows remote attackers to bypass intended access restrictions via a FRAME element within an IFRAME element.…

Record
MGASA-2013-0329
Updated
2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score

MozillaFirefox-50.1.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10071-1
Updated
2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:10218-1 No score

seamonkey-2.40-6.1 on GA media

These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10218-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score

firefox-esr-128.5.1-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14572-1
Updated
2026-11-02
OSVSUSE-SU-2015:0446-1 No score

Security update for Mozilla Firefox

This update to Firefox 17.0.9esr (bnc#840485) addresses:

* MFSA 2013-91 User-defined properties on DOM proxies get the wrong
  'this' object
      o (CVE-2013-1737)
* MFSA 2013-90 Memory corruption involving scrolling
      o use-after-free in mozilla::layout::ScrollbarActivity
        (CVE-2013-1735)
      o Memory corruption in nsGfxScrollFrameInner::IsLTR()
        (CVE-2013-1736)
* MFSA 2013-89 Buffer overflow with multi-column, lists, and floats
      o buffer overflow at nsFloatManager::GetFlowArea() with multicol,
        list, floats (CVE-2013-1732)
* MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes
      o compartment mismatch in nsXBLBinding::DoInitJSClass
        (CVE-2013-1730)
* MFSA 2013-83 Mozilla Updater does not lock MAR file after signature
  verification
      o MAR signature bypass in Updater could lead to downgrade
        (CVE-2013-1726)
* MFSA 2013-82 Calling scope for new Javascript objects can lead to
  memory corruption
      o ABORT: bad scope for new JSObjects: ReparentWrapper /
        document.open (CVE-2013-1725)
* MFSA 2013-79 Use-after-free in Animation Manager during stylesheet
  cloning
      o Heap-use-after-free in nsAnimationManager::BuildAnimations
        (CVE-2013-1722)
* MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 /
  rv:17.0.9)
      o Memory safety bugs fixed in Firefox 17.0.9 and Firefox 24.0
        (CVE-2013-1718)
* MFSA 2013-65 Buffer underflow when generating CRMF requests
      o ASAN heap-buffer-overflow (read 1) in
        cryptojs_interpret_key_gen_type (CVE-2013-1705)

Security Issue references:

* CVE-2013-1737
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1737>
* CVE-2013-1735
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1735>
* CVE-2013-1736
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1736>
* CVE-2013-1732
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1732>
* CVE-2013-1730
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1730>
* CVE-2013-1726
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1726>
* CVE-2013-1725
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1725>
* CVE-2013-1722
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1722>
* CVE-2013-1718
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1718>
* CVE-2013-1705
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1705>
Record
SUSE-SU-2015:0446-1
Updated
2026-11-02
OSVSUSE-SU-2015:0447-1 No score

Security update for Mozilla Firefox

This update to Firefox 17.0.9esr (bnc#840485) addresses:

* MFSA 2013-91 User-defined properties on DOM proxies get the wrong
  'this' object
      o (CVE-2013-1737)
* MFSA 2013-90 Memory corruption involving scrolling
      o use-after-free in mozilla::layout::ScrollbarActivity
        (CVE-2013-1735)
      o Memory corruption in nsGfxScrollFrameInner::IsLTR()
        (CVE-2013-1736)
* MFSA 2013-89 Buffer overflow with multi-column, lists, and floats
      o buffer overflow at nsFloatManager::GetFlowArea() with multicol,
        list, floats (CVE-2013-1732)
* MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes
      o compartment mismatch in nsXBLBinding::DoInitJSClass
        (CVE-2013-1730)
* MFSA 2013-83 Mozilla Updater does not lock MAR file after signature
  verification
      o MAR signature bypass in Updater could lead to downgrade
        (CVE-2013-1726)
* MFSA 2013-82 Calling scope for new Javascript objects can lead to
  memory corruption
      o ABORT: bad scope for new JSObjects: ReparentWrapper /
        document.open (CVE-2013-1725)
* MFSA 2013-79 Use-after-free in Animation Manager during stylesheet
  cloning
      o Heap-use-after-free in nsAnimationManager::BuildAnimations
        (CVE-2013-1722)
* MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 /
  rv:17.0.9)
      o Memory safety bugs fixed in Firefox 17.0.9 and Firefox 24.0
        (CVE-2013-1718)
* MFSA 2013-65 Buffer underflow when generating CRMF requests
      o ASAN heap-buffer-overflow (read 1) in
        cryptojs_interpret_key_gen_type (CVE-2013-1705)

Security Issue references:

* CVE-2013-1737
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1737>
* CVE-2013-1735
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1735>
* CVE-2013-1736
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1736>
* CVE-2013-1732
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1732>
* CVE-2013-1730
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1730>
* CVE-2013-1726
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1726>
* CVE-2013-1725
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1725>
* CVE-2013-1722
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1722>
* CVE-2013-1718
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1718>
* CVE-2013-1705
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1705>
Record
SUSE-SU-2015:0447-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
iceape
Mageia:2
From an advisory covering 55 CVEs
 before 2.22-1.mga2
2.22-1.mga2
iceape
Mageia:3
From an advisory covering 55 CVEs
 before 2.22-1.mga3
2.22-1.mga3
MozillaFirefox
openSUSE:Tumbleweed
From an advisory covering 899 CVEs
 before 50.1.0-1.1
50.1.0-1.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 1860 CVEs
 before 128.5.1-1.1
128.5.1-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-1705 is a high vulnerability (CVSS 10.0) in Mozilla Firefox, published August 7, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.91%, the 90th percentile. No source names a fixed version.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 1,950 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open