# CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability

> CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerability. CVSS 8.8 (CVSS 3.1), in CISA KEV.

Canonical: https://rewindex.com/cve/CVE-2013-1690
Last updated: 2025-10-22T00:05:41Z

- Published: 2013-06-26 01:00 UTC · Updated: 2025-10-22 00:05 UTC · Assigner: mozilla
- CVSS: 8.8 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS: 69.0%, 99th percentile (scored 2026-10-25)
- CISA KEV: yes, added 2022-03-28, federal due date 2022-04-18, ransomware use: Unknown

## Description

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.

## CISA required action

Apply updates per vendor instructions.

## Affected vendors and products

- Mozilla: Firefox and Thunderbird

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2013-1690)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2013-1690)
- [http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html](http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html)
- [http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html](http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html)
- [http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html](http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html)
- [http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html](http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html)
- [http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html](http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html)
- [http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html](http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html)
- [http://rhn.redhat.com/errata/RHSA-2013-0981.html](http://rhn.redhat.com/errata/RHSA-2013-0981.html)
- [http://rhn.redhat.com/errata/RHSA-2013-0982.html](http://rhn.redhat.com/errata/RHSA-2013-0982.html)
- [https://bugzilla.mozilla.org/show\_bug.cgi?id=857883](https://bugzilla.mozilla.org/show_bug.cgi?id=857883)
- [https://bugzilla.mozilla.org/show\_bug.cgi?id=901365](https://bugzilla.mozilla.org/show_bug.cgi?id=901365)
- [https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16996](https://oval.cisecurity.org/repository/search/definition/oval%253Aorg.mitre.oval%253Adef%253A16996)
- [http://www.debian.org/security/2013/dsa-2716](http://www.debian.org/security/2013/dsa-2716)
- [http://www.debian.org/security/2013/dsa-2720](http://www.debian.org/security/2013/dsa-2720)
- [http://www.mozilla.org/security/announce/2013/mfsa2013-53.html](http://www.mozilla.org/security/announce/2013/mfsa2013-53.html)
- [http://www.securityfocus.com/bid/60778](http://www.securityfocus.com/bid/60778)
- [http://www.ubuntu.com/usn/USN-1890-1](http://www.ubuntu.com/usn/USN-1890-1)
- [http://www.ubuntu.com/usn/USN-1891-1](http://www.ubuntu.com/usn/USN-1891-1)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2013-1690 · Markdown: https://rewindex.com/cve/CVE-2013-1690.md · JSON: https://rewindex.com/api/v1/cves/CVE-2013-1690 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:46:01.368Z