© 2026 vulntracker.io

CVE-2013-1675

MEDIUM

6.5

CVSS Score

Published: May 16, 2013 at 10:00 AM UTC

Updated: June 16, 2026 at 11:51 PM UTC

18 products affected across 5 vendorsDebian LinuxUbuntu LinuxFirefox

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.5

Exploitation

CISA KEV

Exploit prediction

EPSS 7%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score6.7%

EPSS (Exploit Prediction Scoring System) estimates a 6.7% chance this CVE is exploited in the wild within the next 30 days — higher than 94% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Mozilla Firefox does not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Required Action

Apply updates per vendor instructions.

Ransomware Use

Unknown

Added to KEV

Mar 3, 2022

Remediation Due

Mar 24, 2022

1678 days overdue

Notes

https://nvd.nist.gov/vuln/detail/CVE-2013-1675

Description

Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux · Canonicalrubygems

95%

12.04 12.10 13.04

Debian Linux · Debiandrupal

95%

Firefox · Mozilla

95%

v < 21.017.0 ≤ v < 17.0.6

Affected range stops below 17.0.6, so it looks safe — our inference, not a vendor statement

Affected range stops below 21.0, so it looks safe — our inference, not a vendor statement

Thunderbird · Mozilla

95%

v < 17.0.6

Affected range stops below 17.0.6, so it looks safe — our inference, not a vendor statement

Thunderbird ESR · Mozilla

95%

17.0 ≤ v < 17.0.6

Affected range stops below 17.0.6, so it looks safe — our inference, not a vendor statement

openSUSE · openSUSE

95%

Enterprise Linux Desktop · Red Hatrubygems

95%

Enterprise Linux Eus · Red Hatrpm

95%

Enterprise Linux for IBM Z Systems · Red Hat

95%

5.0_s390x 6.0_s390x

Enterprise Linux for IBM Z Systems Eus · Red Hat

95%

5.9_s390x 6.4_s390x

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (16)

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory

Source: [email protected]

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00010.html

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory

Source: [email protected]

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00011.html

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory

Source: [email protected]

http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00012.html

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory

Source: [email protected]

http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00006.html

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory

Source: [email protected]

http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00008.html

Vendor Advisoryx_refsource_REDHATThird Party Advisory

Source: [email protected]

http://rhn.redhat.com/errata/RHSA-2013-0820.html

Vendor Advisoryx_refsource_REDHATThird Party Advisory

Source: [email protected]

http://rhn.redhat.com/errata/RHSA-2013-0821.html

Vendor Advisoryx_refsource_DEBIANMailing List

Source: [email protected]

http://www.debian.org/security/2013/dsa-2699

SSVC — Action Prioritization

SSVCActiveNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.5MEDIUMCISA-ADP

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: REQUIRED
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: NONE
Availability: NONE

Vector?

Quick Info

StatusANALYZED

CWE

CWE-665

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card