Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2013-1675

MediumExploitedPublic exploit

Mozilla: Uninitialized functions in DOMSVGZoomEvent (MFSA 2013-47)

Published May 14, 2013 · Updated Mar 9, 2026

Key Facts

Patch immediately
  • CVE-2013-1675 is a medium-severity vulnerability (CVSS 6.5 v3.1) affecting Firefox (Mozilla), Thunderbird (Mozilla), Thunderbird Esr (Mozilla) and 22 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Mar 3, 2022. Public exploit code is available.
  • EPSS estimates a 6.7% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Firefox 0:17.0.6-1.el5_9, Firefox 0:17.0.6-1.el6_4, Firefox 17.0.6-1.0.1.el5_9.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

6.7%

Higher than 93.8% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2013-1675 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVMar 3, 2022Mar 24, 2022Not reported
Industry KEV feedMar 3, 2022Mar 24, 2022Not reported
CIRCL KEVMar 3, 2022Mar 24, 2022Not reported
ENISA EUVDMar 3, 2022n/aNot reported

Required action: Apply updates per vendor instructions.

Affected Products

62 affected entries in total
ProductAffected versionsFixed in
FirefoxMozillaSee advisory21.0
ThunderbirdMozillaSee advisory17.0.6
Thunderbird EsrMozillaSee advisory17.0.6
Gluster Storage Server For On-PremiseRedhat2.1n/a
Ubuntu LinuxCanonical12.04, 12.10, 13.04n/a
20 more affected products in the full CVE brief

Patched Releases

Firefox

0:17.0.6-1.el5_9, 0:17.0.6-1.el6_4, 17.0.6-1.0.1.el5_9, 17.0.6-1.0.1.el6_4, 21.0

firefox-esr

128.5.1-1.1

firefox-esr-branding-upstream

128.5.1-1.1

firefox-esr-translations-common

128.5.1-1.1

firefox-esr-translations-other

128.5.1-1.1

icedove

17.0.7-1~deb7u1

iceweasel

17.0.6esr-1~deb7u1

Thunderbird

17.0.6, 0:17.0.6-1.el5_9, 0:17.0.6-2.el6_4, 17.0.6-1.0.1.el5_9, 17.0.6-2.0.1.el6_4

Thunderbird Esr

17.0.6

MozillaFirefox

50.1.0-1.1

MozillaFirefox-branding-upstream

50.1.0-1.1

MozillaFirefox-buildsymbols

50.1.0-1.1

MozillaFirefox-devel

50.1.0-1.1

MozillaFirefox-translations-common

50.1.0-1.1

MozillaFirefox-translations-other

50.1.0-1.1

MozillaThunderbird

45.5.1-1.1

MozillaThunderbird-buildsymbols

45.5.1-1.1

MozillaThunderbird-devel

45.5.1-1.1

MozillaThunderbird-translations-common

45.5.1-1.1

MozillaThunderbird-translations-other

45.5.1-1.1

xulrunner

0:17.0.6-1.el5_9, 0:17.0.6-2.el6_4, 17.0.6-1.0.1.el5_9, 17.0.6-2.0.1.el6_4

xulrunner-devel

17.0.6-1.0.1.el5_9, 17.0.6-2.0.1.el6_4

Timeline

  1. Publicly disclosed

    May 14, 2013

  2. Added to CISA KEV

    Mar 3, 2022

  3. Added to Industry KEV feed

    Mar 3, 2022

  4. Added to CIRCL KEV

    Mar 3, 2022

  5. Added to ENISA EUVD

    Mar 3, 2022

  6. Last updated

    Mar 9, 2026

Weakness Type

  • CWE-456 Missing Initialization of a Variable
  • CWE-665 Improper Initialization

References

14 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2013-1675 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo