« Back to list

CVE-2013-5598

Status: ModifiedHigh (8.3)—

PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Mozilla — Firefox

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2013-5598",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 8.5,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-10-30T10:55:04.507",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-99.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=920515",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19133",
      "source": "security@mozilla.org"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "security@mozilla.org"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00005.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00006.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mozilla.org/security/announce/2013/mfsa2013-99.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=920515",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19133",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.gentoo.org/glsa/201504-01",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PDF.js in Mozilla Firefox before 25.0 and Firefox ESR 24.x before 24.1 does not properly handle the appending of an IFRAME element, which allows remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges by using this element within an embedded PDF object."
    },
    {
      "lang": "es",
      "value": "PDF.js en Mozilla Firefox anterior a la versión 25.0 y Firefox ESR.x anterior a 24.1 no maneja adecuadamente el anexo de un elemento IFRAME, lo que permite a atacantes remotos leer archivos arbitrarios o ejecutar código JavaScript con los privilegios de chrome mediante el uso de este elemento dentro de un objeto PDF incrustado."
    }
  ],
  "lastModified": "2026-06-16T23:59:04.860",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:24.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18E772D1-DD0F-4F04-8BB4-9550F3C601E1"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:24.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B31FDE6-3EA6-4946-9A76-605F3C561C11"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:24.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46964729-D50D-4F17-A2F9-584A25E6F8DC"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD5C27B1-9A96-4066-B21D-316FB00B6416",
              "versionEndIncluding": "24.0"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:19.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06FF9DFE-491D-4260-8A49-07FD342B9412"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:19.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE09D089-7F48-466B-B03A-C64152A12615"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:19.0.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "653D73DA-21C0-4C3F-9269-5A6D5C5B1E34"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:20.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "804A0ACE-EB28-413D-93F4-E849FEA01390"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:20.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3BA49C6F-9115-41A5-BBDE-743CB9DEDDA8"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:21.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CC8D9A8-D4DB-4BC9-89CE-F3AF742C399F"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:22.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADF6A02E-A85B-48BA-A60C-E92CDA3A8055"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:23.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50127B73-3517-4E82-94E9-FC5AA0DA3357"
            },
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:23.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CBE3FB1-F768-4EEE-A01A-12BB958CDB29"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}