{"id":"CVE-2013-1712","aliases":["EUVD-2013-1739","GHSA-vrw2-q2cc-chx3","SUSE-SU-2015:0446-1","SUSE-SU-2015:0447-1"],"status":"published","title":"Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla...","description":"Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 allow local users to gain privileges via a Trojan horse DLL in (1) the update directory or (2) the current working directory.","severity":{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00387,"percentile":0.32992,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2013-08-07T01:00:00Z","modified":"2026-06-16T23:51:58Z","products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"},{"vendor":"mozilla","product":"thunderbird_esr"}],"references":[{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18014","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"]},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-71.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=859072","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1712"},{"url":"https://github.com/advisories/GHSA-vrw2-q2cc-chx3"},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150446-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/833389","tags":["report"]},{"url":"https://bugzilla.suse.com/840485","tags":["report"]},{"url":"https://bugzilla.suse.com/916196","tags":["report"]},{"url":"https://bugzilla.suse.com/917100","tags":["report"]},{"url":"https://bugzilla.suse.com/917300","tags":["report"]},{"url":"https://bugzilla.suse.com/917597","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0827","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0836","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150447-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-1712","description":"Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 allow local users to gain privileges via a Trojan horse DLL in (1) the update directory or (2) the current working directory.","status":"published","published":"2013-08-07T01:00:00Z","modified":"2024-08-06T15:13:32.523Z","updated_at":"2026-11-02T14:34:58.882751Z"}],"euvd":[{"id":"EUVD-2013-1739","description":"Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 allow local users to gain privileges via a Trojan horse DLL in (1) the update directory or (2) the current working directory.","status":"published","published":"2013-08-07T01:00:00Z","modified":"2024-08-06T15:13:32Z","updated_at":"2026-11-03T01:56:41.063727Z"}],"ghsa":[{"id":"GHSA-vrw2-q2cc-chx3","title":"Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla...","description":"Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 allow local users to gain privileges via a Trojan horse DLL in (1) the update directory or (2) the current working directory.","status":"published","published":"2022-05-17T00:55:54Z","modified":"2023-02-03T05:02:39Z","updated_at":"2026-11-02T14:53:12.750573Z"}],"nvd":[{"id":"CVE-2013-1712","description":"Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 allow local users to gain privileges via a Trojan horse DLL in (1) the update directory or (2) the current working directory.","status":"published","published":"2013-08-07T01:55:04.917Z","modified":"2026-06-16T23:51:58.297Z","cvss":[{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:31.592595Z"}],"osv":[{"id":"SUSE-SU-2015:0446-1","title":"Security update for Mozilla Firefox","description":"\nThis update to Firefox 17.0.9esr (bnc#840485) addresses:\n\n    * MFSA 2013-91 User-defined properties on DOM proxies get the wrong\n      'this' object\n          o (CVE-2013-1737)\n    * MFSA 2013-90 Memory corruption involving scrolling\n          o use-after-free in mozilla::layout::ScrollbarActivity\n            (CVE-2013-1735)\n          o Memory corruption in nsGfxScrollFrameInner::IsLTR()\n            (CVE-2013-1736)\n    * MFSA 2013-89 Buffer overflow with multi-column, lists, and floats\n          o buffer overflow at nsFloatManager::GetFlowArea() with multicol,\n            list, floats (CVE-2013-1732)\n    * MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes\n          o compartment mismatch in nsXBLBinding::DoInitJSClass\n            (CVE-2013-1730)\n    * MFSA 2013-83 Mozilla Updater does not lock MAR file after signature\n      verification\n          o MAR signature bypass in Updater could lead to downgrade\n            (CVE-2013-1726)\n    * MFSA 2013-82 Calling scope for new Javascript objects can lead to\n      memory corruption\n          o ABORT: bad scope for new JSObjects: ReparentWrapper /\n            document.open (CVE-2013-1725)\n    * MFSA 2013-79 Use-after-free in Animation Manager during stylesheet\n      cloning\n          o Heap-use-after-free in nsAnimationManager::BuildAnimations\n            (CVE-2013-1722)\n    * MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 /\n      rv:17.0.9)\n          o Memory safety bugs fixed in Firefox 17.0.9 and Firefox 24.0\n            (CVE-2013-1718)\n    * MFSA 2013-65 Buffer underflow when generating CRMF requests\n          o ASAN heap-buffer-overflow (read 1) in\n            cryptojs_interpret_key_gen_type (CVE-2013-1705)\n\nSecurity Issue references:\n\n    * CVE-2013-1737\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1737\u003e\n    * CVE-2013-1735\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1735\u003e\n    * CVE-2013-1736\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1736\u003e\n    * CVE-2013-1732\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1732\u003e\n    * CVE-2013-1730\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1730\u003e\n    * CVE-2013-1726\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1726\u003e\n    * CVE-2013-1725\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1725\u003e\n    * CVE-2013-1722\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1722\u003e\n    * CVE-2013-1718\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1718\u003e\n    * CVE-2013-1705\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1705\u003e\n\n","status":"published","published":"2013-09-19T11:00:29Z","modified":"2026-02-04T03:40:58.482514Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0447-1","title":"Security update for Mozilla Firefox","description":"\nThis update to Firefox 17.0.9esr (bnc#840485) addresses:\n\n    * MFSA 2013-91 User-defined properties on DOM proxies get the wrong\n      'this' object\n          o (CVE-2013-1737)\n    * MFSA 2013-90 Memory corruption involving scrolling\n          o use-after-free in mozilla::layout::ScrollbarActivity\n            (CVE-2013-1735)\n          o Memory corruption in nsGfxScrollFrameInner::IsLTR()\n            (CVE-2013-1736)\n    * MFSA 2013-89 Buffer overflow with multi-column, lists, and floats\n          o buffer overflow at nsFloatManager::GetFlowArea() with multicol,\n            list, floats (CVE-2013-1732)\n    * MFSA 2013-88 compartment mismatch re-attaching XBL-backed nodes\n          o compartment mismatch in nsXBLBinding::DoInitJSClass\n            (CVE-2013-1730)\n    * MFSA 2013-83 Mozilla Updater does not lock MAR file after signature\n      verification\n          o MAR signature bypass in Updater could lead to downgrade\n            (CVE-2013-1726)\n    * MFSA 2013-82 Calling scope for new Javascript objects can lead to\n      memory corruption\n          o ABORT: bad scope for new JSObjects: ReparentWrapper /\n            document.open (CVE-2013-1725)\n    * MFSA 2013-79 Use-after-free in Animation Manager during stylesheet\n      cloning\n          o Heap-use-after-free in nsAnimationManager::BuildAnimations\n            (CVE-2013-1722)\n    * MFSA 2013-76 Miscellaneous memory safety hazards (rv:24.0 /\n      rv:17.0.9)\n          o Memory safety bugs fixed in Firefox 17.0.9 and Firefox 24.0\n            (CVE-2013-1718)\n    * MFSA 2013-65 Buffer underflow when generating CRMF requests\n          o ASAN heap-buffer-overflow (read 1) in\n            cryptojs_interpret_key_gen_type (CVE-2013-1705)\n\nSecurity Issue references:\n\n    * CVE-2013-1737\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1737\u003e\n    * CVE-2013-1735\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1735\u003e\n    * CVE-2013-1736\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1736\u003e\n    * CVE-2013-1732\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1732\u003e\n    * CVE-2013-1730\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1730\u003e\n    * CVE-2013-1726\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1726\u003e\n    * CVE-2013-1725\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1725\u003e\n    * CVE-2013-1722\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1722\u003e\n    * CVE-2013-1718\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1718\u003e\n    * CVE-2013-1705\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1705\u003e\n\n","status":"published","published":"2013-09-19T09:38:57Z","modified":"2026-02-04T03:28:16.012094Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}