Back to CVE records
Medium 6.5Known exploited (CISA KEV)Published May 16, 2013
CVE-2013-1675Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mP…
Updated under an hour ago ()
Does this affect you?
It affects mozilla firefox and 17 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Mar 3, 2022; federal agencies had to remediate by Mar 24, 2022. Treat that date as your deadline.
Do this next
Start free and add your stack
Free account, 1 product
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
- CVSS
- 6.5 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-665
- Known exploited
- Added to CISA KEV Mar 3, 2022; federal remediation due Mar 24, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 6.70% (percentile 94)
- Assigned by
- mozilla
- NVD analysis
- Analyzed
- Record last updated
- Oct 22, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
mozilla firefox mozilla:firefox | before 21.0; from 17.0 before 17.0.6 | NVD |
mozilla thunderbird mozilla:thunderbird | before 17.0.6 | NVD |
mozilla thunderbird_esr mozilla:thunderbird_esr | from 17.0 before 17.0.6 | NVD |
canonical ubuntu_linux canonical:ubuntu_linux | 12.04; 12.10; 13.04 | NVD |
debian debian_linux debian:debian_linux | 7.0 | NVD |
redhat gluster_storage_server_for_on-premise redhat:gluster_storage_server_for_on-premise | 2.1 | NVD |
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop | 5.0; 6.0 | NVD |
redhat enterprise_linux_eus redhat:enterprise_linux_eus | 5.9; 6.4 | NVD |
redhat enterprise_linux_for_ibm_z_systems redhat:enterprise_linux_for_ibm_z_systems | 5.0_s390x; 6.0_s390x | NVD |
redhat enterprise_linux_for_ibm_z_systems_eus redhat:enterprise_linux_for_ibm_z_systems_eus | 5.9_s390x; 6.4_s390x | NVD |
redhat enterprise_linux_for_power_big_endian redhat:enterprise_linux_for_power_big_endian | 5.0_ppc; 6.0_ppc64 | NVD |
redhat enterprise_linux_for_power_big_endian_eus redhat:enterprise_linux_for_power_big_endian_eus | 5.9_ppc; 6.4_ppc64 | NVD |
redhat enterprise_linux_for_scientific_computing redhat:enterprise_linux_for_scientific_computing | 6.0 | NVD |
redhat enterprise_linux_server redhat:enterprise_linux_server | 5.0; 6.0 | NVD |
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus | 5.9; 6.4 | NVD |
redhat enterprise_linux_server_eus_from_rhui redhat:enterprise_linux_server_eus_from_rhui | 5.9; 6.4 | NVD |
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation | 5.0; 6.0 | NVD |
opensuse opensuse opensuse:opensuse | 12.2; 12.3 | NVD |
References
- http://www.debian.org/security/2013/dsa-2699vendor-advisory, x-refsource-debian, mailing-list
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:165vendor-advisory, x-refsource-mandriva, broken-link
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=866825x-refsource-confirm, exploit, issue-tracking
- http://www.ubuntu.com/usn/USN-1823-1vendor-advisory, x-refsource-ubuntu, third-party-advisory
- http://rhn.redhat.com/errata/RHSA-2013-0821.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- http://www.mozilla.org/security/announce/2013/mfsa2013-47.htmlx-refsource-confirm, vendor-advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16976vdb-entry, signature, x-refsource-oval, broken-link
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- http://rhn.redhat.com/errata/RHSA-2013-0820.htmlvendor-advisory, x-refsource-redhat, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.htmlvendor-advisory, x-refsource-suse, mailing-list, third-party-advisory
- http://www.securityfocus.com/bid/59858vdb-entry, x-refsource-bid, broken-link, third-party-advisory
- http://www.ubuntu.com/usn/USN-1822-1vendor-advisory, x-refsource-ubuntu, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-1675us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.