CVE-2013-1675: Mozilla Firefox and Thunderbird uninitialized memory information disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with known exploitation and a past remediation due date, and it affects widely deployed browsers and mail clients, though it only exposes memory data.

What it is

Firefox, Firefox ESR, Thunderbird and Thunderbird ESR fail to properly initialize the nsDOMSVGZoomEvent::mPreviousScale and mNewScale data structures. A crafted web site can cause the browser to read uninitialized process memory and expose that data to the attacker. The flaw affects confidentiality only, with no integrity or availability impact.

Impact

An attacker can obtain sensitive information from process memory, potentially including data from other pages or the browser process. There is no code execution, data modification or denial of service from this flaw alone.

Attack surface

Reached over the network by a victim visiting a crafted web site; the CVSS vector shows no privileges required but user interaction is required, so the victim must load the malicious page. No authentication is needed.

Exploitation

The record is listed in CISA KEV with a due date of 2022-03-24, and one reference is tagged as an exploit, indicating known exploitation. EPSS is 0.06696 (93.5th percentile), so short-term exploitation probability is moderate.

What to do

• Upgrade Firefox to 21.0 or later, Firefox ESR to 17.0.6 or later, and Thunderbird/Thunderbird ESR to 17.0.6 or later.
• Apply the vendor and distribution updates referenced in the Mozilla advisory and the Red Hat, Debian, Ubuntu and openSUSE advisories.
• If immediate upgrade is not possible, restrict browsing to trusted sites and disable or limit JavaScript and SVG content in affected clients.
• Track the CISA KEV remediation due date and confirm all affected endpoints and mail clients are patched.

Detection

• Inventory Firefox, Firefox ESR, Thunderbird and Thunderbird ESR versions across endpoints and flag anything below 21.0 or 17.0.6.
• Monitor proxy, DNS and browser telemetry for visits to known malicious or exploit-hosting sites that target this flaw.
• Review endpoint logs for unusual browser crashes or memory-related errors in Firefox or Thunderbird processes.
• Check patch management reports for the referenced Mozilla, Red Hat, Debian, Ubuntu and openSUSE advisories to confirm remediation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.