CVE-2013-1690: Mozilla Firefox and Thunderbird memory corruption via onreadystatechange handling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution with user interaction, is listed in CISA KEV, and has a very high EPSS score, though exploitation requires a user to open crafted content.

What it is

Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7 and Thunderbird ESR 17.x before 17.0.7 mishandle onreadystatechange events combined with page reloading, causing execution of data at an unmapped memory location. This can crash the application or potentially allow arbitrary code execution when a victim views a crafted web page.

Impact

An attacker can crash the browser or mail client and may achieve arbitrary code execution in the context of the affected application. Successful code execution would give the attacker the privileges of the user running Firefox or Thunderbird.

Attack surface

Reached remotely over the network by luring a user to a crafted web site or message that triggers the onreadystatechange and reload sequence. No authentication is required, but user interaction (opening the page or content) is needed per the CVSS vector UI:R.

Exploitation

CVE-2013-1690 is listed in CISA KEV (added 2022-03-28) and has a high EPSS 30-day probability of 0.69021 (99.3rd percentile), indicating observed exploitation activity. No ransomware campaign use is documented.

What to do

• Upgrade Firefox to 22.0 or later and Firefox ESR to 17.0.7 or later; upgrade Thunderbird and Thunderbird ESR to 17.0.7 or later.
• Apply the vendor and distribution updates referenced in the Mozilla MFSA 2013-53 advisory and the Red Hat, Debian, Ubuntu, and openSUSE errata.
• If immediate patching is not possible, restrict browsing and mail rendering of untrusted content and disable JavaScript where feasible.
• Track KEV remediation due date (2022-04-18) and confirm all affected endpoints and servers are updated.

Detection

• Monitor for Firefox or Thunderbird crash reports and abnormal process terminations on endpoints running unpatched versions.
• Hunt for exploitation attempts via proxy, IDS, or web logs showing crafted pages that combine onreadystatechange handlers with forced reloads.
• Check asset inventories for Firefox versions below 22.0, Firefox ESR below 17.0.7, and Thunderbird below 17.0.7.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.