CVE-2013-1690
HighExploitedPublic exploitMozilla: Execution of unmapped memory through onreadystatechange event (MFSA 2013-53)
Published Jun 25, 2013 · Updated Mar 9, 2026
Key Facts
Patch immediately- CVE-2013-1690 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Firefox (Mozilla), Thunderbird (Mozilla), Thunderbird Esr (Mozilla) and 22 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 13, 2013. Public exploit code is available.
- EPSS estimates a 69% probability of exploitation in the next 30 days.
- Fixed versions are available, including Firefox 0:17.0.7-1.el5_9, Firefox 0:17.0.7-1.el6_4, Firefox 17.0.7-1.0.1.el5_9.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
69%
Higher than 99.3% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2013-1690 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| Industry KEV feed | Sep 13, 2013 | Apr 18, 2022 | Not reported |
| CIRCL KEV | Mar 28, 2022 | Apr 18, 2022 | Not reported |
| ENISA EUVD | Mar 28, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
69 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FirefoxMozilla | See advisory | 22.0 |
| ThunderbirdMozilla | See advisory | 17.0.7 |
| Thunderbird EsrMozilla | See advisory | 17.0.7 |
| Gluster Storage Server For On-PremiseRedhat | 2.0 | n/a |
| Ubuntu LinuxCanonical | 12.04, 12.10, 13.04 | n/a |
Patched Releases
Firefox
0:17.0.7-1.el5_9, 0:17.0.7-1.el6_4, 17.0.7-1.0.1.el5_9, 17.0.7-1.0.1.el6_4, 22.0
firefox-esr
128.5.1-1.1
firefox-esr-branding-upstream
128.5.1-1.1
firefox-esr-translations-common
128.5.1-1.1
firefox-esr-translations-other
128.5.1-1.1
icedove
17.0.7-1~deb7u1
iceweasel
17.0.7esr-1~deb7u1
Thunderbird
17.0.7, 0:17.0.7-1.el5_9, 0:17.0.7-1.el6_4, 17.0.7-1.0.1.el5_9, 17.0.7-1.0.1.el6_4
Thunderbird Esr
17.0.7
MozillaFirefox
50.1.0-1.1
MozillaFirefox-branding-upstream
50.1.0-1.1
MozillaFirefox-buildsymbols
50.1.0-1.1
MozillaFirefox-devel
50.1.0-1.1
MozillaFirefox-translations-common
50.1.0-1.1
MozillaFirefox-translations-other
50.1.0-1.1
MozillaThunderbird
45.5.1-1.1
MozillaThunderbird-buildsymbols
45.5.1-1.1
MozillaThunderbird-devel
45.5.1-1.1
MozillaThunderbird-translations-common
45.5.1-1.1
MozillaThunderbird-translations-other
45.5.1-1.1
seamonkey
2.40-6.1
seamonkey-dom-inspector
2.40-6.1
seamonkey-irc
2.40-6.1
seamonkey-translations-common
2.40-6.1
seamonkey-translations-other
2.40-6.1
Timeline
Publicly disclosed
Jun 25, 2013
Added to Industry KEV feed
Sep 13, 2013
Added to CISA KEV
Mar 28, 2022
Added to CIRCL KEV
Mar 28, 2022
Added to ENISA EUVD
Mar 28, 2022
Last updated
Mar 9, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- advisoryopenSUSE-SU-2013:1140
- advisoryopenSUSE-SU-2013:1141
- advisoryopenSUSE-SU-2013:1142
- advisoryopenSUSE-SU-2013:1143
- advisorySUSE-SU-2013:1152
FAQ
Common Questions.
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrar…
Affected: Firefox (Mozilla); Thunderbird (Mozilla); Thunderbird Esr (Mozilla), among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Sep 13, 2013.
Yes. It was added on Mar 28, 2022 with a federal remediation due date of Apr 18, 2022.
Public exploit code is available.
Fixed versions are available, including Firefox 0:17.0.7-1.el5_9, Firefox 0:17.0.7-1.el6_4, Firefox 17.0.7-1.0.1.el5_9.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2013-1690 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo