Search for vulnerabilities
| Vulnerability ID | VCID-161c-812n-ffen |
| Aliases |
CVE-2013-0757
|
| Summary | Multiple vulnerabilities have been found in Mozilla Firefox, Thunderbird, and SeaMonkey, some of which may allow a remote user to execute arbitrary code. |
| Status | Published |
| Exploitability | None |
| Weighted Severity | None |
| Risk | None |
| Affected and Fixed Packages | Package Details |
| CWE-20 | Improper Input Validation |
| System | Score | Found at |
|---|---|---|
| epss | 0.74572 | https://api.first.org/data/v1/epss?cve=CVE-2013-0757 |
| epss | 0.74572 | https://api.first.org/data/v1/epss?cve=CVE-2013-0757 |
| epss | 0.74572 | https://api.first.org/data/v1/epss?cve=CVE-2013-0757 |
| epss | 0.74572 | https://api.first.org/data/v1/epss?cve=CVE-2013-0757 |
| epss | 0.74572 | https://api.first.org/data/v1/epss?cve=CVE-2013-0757 |
| epss | 0.74572 | https://api.first.org/data/v1/epss?cve=CVE-2013-0757 |
| epss | 0.74572 | https://api.first.org/data/v1/epss?cve=CVE-2013-0757 |
| epss | 0.74572 | https://api.first.org/data/v1/epss?cve=CVE-2013-0757 |
| epss | 0.74572 | https://api.first.org/data/v1/epss?cve=CVE-2013-0757 |
| cvssv2 | 9.3 | https://nvd.nist.gov/vuln/detail/CVE-2013-0757 |
| generic_textual | high | https://www.mozilla.org/en-US/security/advisories/mfsa2013-14 |
| Data source | Exploit-DB |
|---|---|
| Date added | March 23, 2017 |
| Description | GIT 1.8.5.6/1.9.5/2.0.5/2.1.4/2.2.1 & Mercurial < 3.2.3 - Multiple Vulnerabilities (Metasploit) |
| Ransomware campaign use | Known |
| Source publication date | Dec. 18, 2014 |
| Exploit type | remote |
| Platform | multiple |
| Source update date | March 23, 2017 |
| Source URL | https://github.com/rapid7/metasploit-framework/blob/1d617ae3894222cfbbf6951fcd68fd2d1c1b15c6/modules/exploits/multi/http/git_client_command_exec.rb |
| Data source | Metasploit |
|---|---|
| Description | This exploit gains remote code execution on Firefox 17 and 17.0.1, provided the user has installed Flash. No memory corruption is used. First, a Flash object is cloned into the anonymous content of the SVG "use" element in the <body> (CVE-2013-0758). From there, the Flash object can navigate a child frame to a URL in the chrome:// scheme. Then a separate exploit (CVE-2013-0757) is used to bypass the security wrapper around the child frame's window reference and inject code into the chrome:// context. Once we have injection into the chrome execution context, we can write the payload to disk, chmod it (if posix), and then execute. Note: Flash is used here to trigger the exploit but any Firefox plugin with script access should be able to trigger it. |
| Note | Reliability: - unknown-reliability Stability: - unknown-stability SideEffects: - unknown-side-effects |
| Ransomware campaign use | Unknown |
| Source publication date | Jan. 8, 2013 |
| Platform | Firefox,Java,Linux,OSX,Solaris,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/browser/firefox_svg_plugin.rb |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
| Percentile | 0.98842 |
| EPSS Score | 0.74572 |
| Published At | April 1, 2026, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-04-01T13:02:28.521275+00:00 | Gentoo Importer | Import | https://security.gentoo.org/glsa/201309-23 | 38.0.0 |