CVE-2013-1690
Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2013-1690
Description
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitation Context
as of October 13, 2026- CISA added CVE-2013-1690 to the KEV catalog 3,197 days after its CVE record was published.
- It is one of 13 Mozilla entries in the CISA KEV catalog, and one of 7 added in 2022.
- Its current EPSS score (69.0%) is higher than that of 57% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| - | - | n/a |
References
17 LinksRecord Details
More from Mozilla
Mozilla Firefox and Thunderbird Sandbox Escape Vulnerability
Mozilla Firefox And Thunderbird Type Confusion Vulnerability
Mozilla Firefox and Thunderbird Type Confusion Vulnerability
Mozilla Firefox And Thunderbird Use-After-Free Vulnerability
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.