CVE-2013-0787

Estado: ModificadaAlta (9.3)—
Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call.
CVSS

Versión: 2.0
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Puntuación base: 9.3
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 6.40%
Percentil entre todas las CVEs puntuadas: 93
Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (4)

Mozilla — Firefox Mozilla — Seamonkey Mozilla — Thunderbird Mozilla — Thunderbird ESR
CWE

CWE-399
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-0787",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-03-11T10:55:00.990",
  "references": [
    {
      "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://twitter.com/VUPEN/statuses/309505403631325184",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://twitter.com/thezdi/statuses/309484730506698752",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2699",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/58391",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1758-1",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00010.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00023.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00025.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00026.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00028.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0614.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://rhn.redhat.com/errata/RHSA-2013-0627.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://twitter.com/VUPEN/statuses/309505403631325184",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://twitter.com/thezdi/statuses/309484730506698752",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.debian.org/security/2013/dsa-2699",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-29.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/58391",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1758-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=848644",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16737",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en la gestión de recursos en la función nsEditor::IsPreformatted en editor/libeditor/base/nsEditor.cpp en Mozilla Firefox anterior a v19.0.2, Firefox ESR v17.x anterior a v17.0.4, Thunderbird anterior a v17.0.4, Thunderbird ESR v17.x anterior a v17.0.4, y SeaMonkey anterior a v2.16.1 permite a atacantes remotos ejecutar código arbitrario a través de vectores relacionados con la llamada execCommand."
    }
  ],
  "lastModified": "2026-06-16T23:50:05.740",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "254BCF5F-C79D-4D88-A937-913FD01E017C",
              "versionEndIncluding": "19.0.1"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3283FBAC-B77A-4C62-9D51-70BB35FA3D13"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "886D8A1F-ECDD-4FE9-A4E5-2322EEC0B880"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E10B8803-C319-4AAA-81CF-FA206A33BA55"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2B5567C-8969-456D-B6DF-3562B99C41FE"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "719210EC-B94E-447B-BEC9-598A02E65C68",
              "versionEndIncluding": "17.0.3"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2FD78A8-0D3A-412C-8776-20C598697564"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "777D8DC5-8D43-4842-B0A7-3C933F41F6E8"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:17.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "808C66D2-4C53-4544-AD21-443D9A400B84"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "341D94CE-C0EB-47FA-A043-E7B0F4344BBB"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84C3EE07-F201-451A-89A1-A41B8B2165E6"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45837B42-7D29-4475-94F1-E29CD5831C7F"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird_esr:17.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7028A433-7D1B-4C6F-A0F6-1B69682F7853"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F214CD49-A7BC-4D17-ADCD-FDF995B9B61A",
              "versionEndIncluding": "2.16"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AF84523-CBF7-4F1D-9818-9DAFED30851D"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51C344C3-093D-486E-B2BA-47E890FC159B"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7D8ED22-2F5A-408E-995F-D6B046250EC7"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7744088-C55D-4006-8A1C-545DF9687A5A"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:seamonkey:2.16:beta5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B888F4F3-F5C1-47CB-85EA-BF088B3629FD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}