{"id":"CVE-2013-1675","kind":"vulnerability","aliases":["CVE-2013-1675"],"related":[],"title":"Mozilla Firefox: Mozilla Firefox Information Disclosure Vulnerability","description":"Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.","summary":"Firefox does not initialize memory for SVG zoom event fields, so a crafted web page can read uninitialized data from the browser process memory. An attacker gets sensitive information from memory, not code execution.","severity":"medium","cvss":6.5,"epss":0.06696,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Mozilla Firefox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["desktop-browsers","exploited","firefox","package"],"not_affected_if":["firefox-not-installed","fixed-version-running"],"how_to_check":null,"fix":"Update Firefox to a release that includes the Mozilla fix for CVE-2013-1675; the exact fixed version is not stated in the sources.\nCISA's required action is to apply the vendor updates.","status":"open","published_at":"2013-05-16T11:45:30+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:16+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T21:26:16Z","model":"claude-haiku-5-5","output":{"fix":"Update Firefox to a release that includes the Mozilla fix for CVE-2013-1675; the exact fixed version is not stated in the sources.\nCISA's required action is to apply the vendor updates.","reach":"internet","impact":"low","summary":"Firefox does not initialize memory for SVG zoom event fields, so a crafted web page can read uninitialized data from the browser process memory. An attacker gets sensitive information from memory, not code execution.","category":"package","who_cares":["firefox","desktop-browsers"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote page reads sensitive data from browser process memory","analyst_note":"Find the fixed Firefox version and the Mozilla security advisory for CVE-2013-1675 to fill in how_to_check and fix; the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["firefox-not-installed","fixed-version-running"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000472,"input_tokens":2876,"output_tokens":368,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1675':10A,13A '-2013':9A,12A '17':62C,72C '17.0.6':65C,68C,75C '21.0':59C 'allow':91C 'attack':47B,93C 'browser':18B,43B 'code':54B 'craft':34B,103C 'cve':8A,11A 'data':40B,80C 'desktop':17B 'desktop-brows':16B 'disclosur':6A 'esr':61C,71C 'event':30B 'execut':55B 'exploit':19B 'field':31B 'firefox':2A,4A,15A,20B,22B,57C,60C 'function':89C 'get':48B 'inform':5A,50B,97C 'initi':25B,79C 'memori':26B,45B,52B,100C 'mnewscal':88C 'mozilla':1A,3A,14A,56C 'mpreviousscal':85C 'nsdomsvgzoomev':84C,87C 'obtain':95C 'packag':21B 'page':36B 'process':44B,99C 'proper':78C 'read':38B 'remot':92C 'sensit':49B,96C 'site':105C 'structur':81C 'svg':28B 'thunderbird':66C,70C 'uniniti':39B 'via':101C 'vulner':7A 'web':35B,104C 'x':63C,73C 'zoom':29B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2013-05-16T11:45:30+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2013-1675","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2013-1675","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2013-1675","url":"https://api.first.org/data/v1/epss?cve=CVE-2013-1675","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2013-1675","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1675","severity":null,"published_at":"2013-05-16T11:45:30+00:00","modified_at":"2026-06-16T23:51:53+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}