CVE-2013-5599
Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka...
Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.
Exploit likelihood
What each source reports
NVD Score used
Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.
- Record
CVE-2013-5599- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.
- Record
CVE-2013-5599- Updated
- 2026-11-02
EUVDEUVD-2013-5439 No score
Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.
- Record
EUVD-2013-5439- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hv5q-6ffq-rj2h No score
Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka...
Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.
- Record
GHSA-hv5q-6ffq-rj2h- Updated
- 2026-11-02
OSVMGASA-2013-0320 No score
Updated firefox & related packages fix multiple security vulnerabilities
Updated firefox packages fix security vulnerabilities:
Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure (CVE-2013-1739).
Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to terminate unexpectedly or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2013-5590, CVE-2013-5597, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602).
It was found that the Firefox JavaScript engine incorrectly allocated memory for certain functions. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Firefox (CVE-2013-5595).
A flaw was found in the way Firefox handled certain Extensible Stylesheet Language Transformations (XSLT) files. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Firefox (CVE-2013-5604).
Additionally, the rootcerts, nspr, nss, and sqlite3 packages have been updated to newer versions required by this update.
- Record
MGASA-2013-0320- Updated
- 2026-11-02
OSVMGASA-2013-0326 No score
Updated thunderbird package fixes security vulnerabilities
Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2013-5590, CVE-2013-5597, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602).
It was found that the Thunderbird JavaScript engine incorrectly allocated memory for certain functions. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Thunderbird (CVE-2013-5595).
A flaw was found in the way Thunderbird handled certain Extensible Stylesheet Language Transformations (XSLT) files. An attacker could combine this flaw with other vulnerabilities to execute arbitrary code with the privileges of the user running Thunderbird (CVE-2013-5604).
Also, the thunderbird-lightning extension has been updated to a version that is compatible with the updated Thunderbird.
- Record
MGASA-2013-0326- Updated
- 2026-11-02
Show 5 moreShow less
OSVMGASA-2013-0329 No score
Updated iceape packages fix many vulnerabilities
Updated iceape packages fix security issues:
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2013-1682)
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2013-1683)
Use-after-free vulnerability in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site. (CVE-2013-1684)
Use-after-free vulnerability in the nsIDocument::GetRootElement function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site. (CVE-2013-1685)
Use-after-free vulnerability in the mozilla::ResetDir function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors. (CVE-2013-1686)
The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site. (CVE-2013-1687)
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location. (CVE-2013-1690)
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web site. (CVE-2013-1692)
The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly bypass the Same Origin Policy and read text from a different domain, by observing timing differences in execution of filter code. (CVE-2013-1693)
The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag. (CVE-2013-1694)
Mozilla Firefox before 22.0 does not properly implement certain DocShell inheritance behavior for the sandbox attribute of an IFRAME element, which allows remote attackers to bypass intended access restrictions via a FRAME element within an IFRAME element.…
- Record
MGASA-2013-0329- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10071-1 No score
MozillaFirefox-50.1.0-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-50.1.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10218-1 No score
seamonkey-2.40-6.1 on GA media
These are all security issues fixed in the seamonkey-2.40-6.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10218-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10230-1 No score
MozillaThunderbird-45.5.1-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-45.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10230-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
iceweaselDebian:7 From an advisory covering 8 CVEs |
before 17.0.10esr-1~deb7u1, plus listed versions 10.0.12esr-110.0.12esr-1+alpha10.0.12esr-1+nmu110.0.12esr-1+nmu1+alpha11.0-1 Show 41 moreShow less11.0-211.0-311.0-411.0~b1-111.0~b1-211.0~b2-111.0~b3-111.0~b4-111.0~b5-111.0~b6-112.0-112.0-212.0-312.0-412.0-512.0-612.0-713.0-113.0.1-113.0.1-214.0.1-114.0.1-215.0-115.0.1-116.0-116.0.1-116.0.2-117.0-117.0.1-117.0.1-217.0.5esr-117.0.6esr-117.0.6esr-1~deb7u117.0.7esr-117.0.7esr-1~deb7u117.0.7esr-217.0.8esr-117.0.8esr-1~deb7u117.0.8esr-217.0.8esr-2~deb7u117.0.9esr-1~deb7u1 |
17.0.10esr-1~deb7u1 |
icedoveDebian:7 From an advisory covering 8 CVEs |
before 17.0.10-1~deb7u1, plus listed versions 10.0.12-111.0-116.0.2-117.0-117.0.2-1 Show 10 moreShow less17.0.4-117.0.5-117.0.5-217.0.7-117.0.7-1~deb7u117.0.8-117.0.8-1~deb7u117.0.9-117.0.9-1~deb7u117.0.9-2 |
17.0.10-1~deb7u1 |
sqlite3Mageia:2 From an advisory covering 9 CVEs |
before 3.7.17-1.mga2 | 3.7.17-1.mga2 |
rootcertsMageia:2 From an advisory covering 9 CVEs |
before 20130411.00-1.mga2 | 20130411.00-1.mga2 |
nsprMageia:2 From an advisory covering 9 CVEs |
before 4.10.1-1.mga2 | 4.10.1-1.mga2 |
nssMageia:2 From an advisory covering 9 CVEs |
before 3.15.2-1.1.mga2 | 3.15.2-1.1.mga2 |
firefoxMageia:2 From an advisory covering 9 CVEs |
before 24.1.0-1.mga2 | 24.1.0-1.mga2 |
firefox-l10nMageia:2 From an advisory covering 9 CVEs |
before 24.1.0-1.mga2 | 24.1.0-1.mga2 |
sqlite3Mageia:3 From an advisory covering 9 CVEs |
before 3.7.17-1.mga3 | 3.7.17-1.mga3 |
rootcertsMageia:3 From an advisory covering 9 CVEs |
before 20130411.00-1.mga3 | 20130411.00-1.mga3 |
Show 57 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nsprMageia:3 From an advisory covering 9 CVEs |
before 4.10.1-1.mga3 | 4.10.1-1.mga3 |
nssMageia:3 From an advisory covering 9 CVEs |
before 3.15.2-1.1.mga3 | 3.15.2-1.1.mga3 |
firefoxMageia:3 From an advisory covering 9 CVEs |
before 24.1.0-1.mga3 | 24.1.0-1.mga3 |
firefox-l10nMageia:3 From an advisory covering 9 CVEs |
before 24.1.0-1.mga3 | 24.1.0-1.mga3 |
thunderbirdMageia:2 From an advisory covering 8 CVEs |
before 24.1.0-1.mga2 | 24.1.0-1.mga2 |
thunderbird-l10nMageia:2 From an advisory covering 8 CVEs |
before 24.1.0-1.mga2 | 24.1.0-1.mga2 |
thunderbird-lightningMageia:2 From an advisory covering 8 CVEs |
before 2.6.2-1.mga2 | 2.6.2-1.mga2 |
thunderbirdMageia:3 From an advisory covering 8 CVEs |
before 24.1.0-1.mga3 | 24.1.0-1.mga3 |
thunderbird-l10nMageia:3 From an advisory covering 8 CVEs |
before 24.1.0-1.mga3 | 24.1.0-1.mga3 |
thunderbird-lightningMageia:3 From an advisory covering 8 CVEs |
before 2.6.2-1.mga3 | 2.6.2-1.mga3 |
iceapeMageia:2 From an advisory covering 55 CVEs |
before 2.22-1.mga2 | 2.22-1.mga2 |
iceapeMageia:3 From an advisory covering 55 CVEs |
before 2.22-1.mga3 | 2.22-1.mga3 |
firefoxRed Hat:enterprise_linux:5::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
firefox-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
xulrunnerRed Hat:enterprise_linux:5::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
xulrunnerRed Hat:enterprise_linux:5::client_workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
xulrunner-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
firefoxRed Hat:enterprise_linux:5::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
firefox-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
xulrunnerRed Hat:enterprise_linux:5::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
xulrunner-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
xulrunner-develRed Hat:enterprise_linux:5::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
firefoxRed Hat:enterprise_linux:6::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
firefox-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunnerRed Hat:enterprise_linux:6::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunner-develRed Hat:enterprise_linux:6::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
firefoxRed Hat:enterprise_linux:6::computenode From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
firefox-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunnerRed Hat:enterprise_linux:6::computenode From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::computenode From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunner-develRed Hat:enterprise_linux:6::computenode From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
firefoxRed Hat:enterprise_linux:6::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
firefox-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunnerRed Hat:enterprise_linux:6::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunner-develRed Hat:enterprise_linux:6::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
firefoxRed Hat:enterprise_linux:6::workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
firefox-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunnerRed Hat:enterprise_linux:6::workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunner-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
xulrunner-develRed Hat:enterprise_linux:6::workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
thunderbirdRed Hat:enterprise_linux:5::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
thunderbird-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
thunderbirdRed Hat:rhel_productivity:5 From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
thunderbird-debuginfoRed Hat:rhel_productivity:5 From an advisory covering 8 CVEs |
before 0:17.0.10-1.el5_10 | 0:17.0.10-1.el5_10 |
thunderbirdRed Hat:enterprise_linux:6::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::client From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
thunderbirdRed Hat:enterprise_linux:6::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::server From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
thunderbirdRed Hat:enterprise_linux:6::workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
thunderbird-debuginfoRed Hat:enterprise_linux:6::workstation From an advisory covering 8 CVEs |
before 0:17.0.10-1.el6_4 | 0:17.0.10-1.el6_4 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 899 CVEs |
before 50.1.0-1.1 | 50.1.0-1.1 |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 560 CVEs |
before 45.5.1-1.1 | 45.5.1-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-5599 is a high vulnerability (CVSS 10.0) in Mozilla Firefox, published October 30, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.19%, the 92nd percentile. No source names a fixed version.
References
mozilla.org/security/announce/2013/mfsa2013-100.html
lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html
security.gentoo.org/glsa/201504-01
rhn.redhat.com/errata/RHSA-2013-1480.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19315
Show 194 moreShow less
debian.org/security/2013/dsa-2788
bugzilla.mozilla.org/show_bug.cgi?id=915210
nvd.nist.gov/vuln/detail/CVE-2013-5599
github.com/advisories/GHSA-hv5q-6ffq-rj2h
advisories.mageia.org/MGASA-2013-0320.html
mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:257
bugs.mageia.org/show_bug.cgi?id=11370
access.redhat.com/errata/RHSA-2013:1476
bugzilla.redhat.com/show_bug.cgi?id=983488
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1476.json
cve.org/CVERecord?id=CVE-2013-5590
suse.com/security/cve/CVE-2008-5913
Left out here: 2,000 references and the rest of 1 source description. The JSON record has them.