{"api_version":"1","generated_at":"2026-07-23T10:14:29+00:00","cve":"CVE-2013-0771","urls":{"html":"https://cve.report/CVE-2013-0771","api":"https://cve.report/api/cve/CVE-2013-0771.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-0771","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-0771"},"summary":{"title":"CVE-2013-0771","description":"Heap-based buffer overflow in the gfxTextRun::ShrinkToLigatureBoundaries function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.","state":"PUBLISHED","assigner":"mozilla","published_at":"2013-01-13 20:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-787","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html","name":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[security-announce] openSUSE-SU-2013:0149-1: important: Mozilla Januarys","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-1681-1","name":"http://www.ubuntu.com/usn/USN-1681-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-1681-1: Firefox vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html","name":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[security-announce] SUSE-SU-2013:0048-1: important: Security update for","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-1681-2","name":"http://www.ubuntu.com/usn/USN-1681-2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-1681-2: Thunderbird vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html","name":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[security-announce] openSUSE-SU-2013:0131-1: important: Mozilla Januarys","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=785555","name":"https://bugzilla.mozilla.org/show_bug.cgi?id=785555","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Vendor Advisory"],"title":"785555 – (CVE-2013-0771) Heap-buffer-overflow in gfxTextRun::ShrinkToLigatureBoundaries","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-02.html","name":"http://www.mozilla.org/security/announce/2013/mfsa2013-02.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"MFSA 2013-02: Use-after-free and buffer overflow issues found using Address Sanitizer","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.ubuntu.com/usn/USN-1681-4","name":"http://www.ubuntu.com/usn/USN-1681-4","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"USN-1681-4: Firefox regression | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html","name":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"title":"[security-announce] SUSE-SU-2013:0049-1: important: Security update for","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17019","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17019","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0771","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0771","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"771","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2013-0771","qid":"690332","title":"Free Berkeley Software Distribution (FreeBSD) Security Update for mozilla (a4ed6632-5aa9-11e2-8fcb-c8600054b392)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T14:41:47.077Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"oval:org.mitre.oval:def:17019","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17019"},{"name":"SUSE-SU-2013:0048","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html"},{"name":"openSUSE-SU-2013:0131","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-02.html"},{"name":"USN-1681-4","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1681-4"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=785555"},{"name":"SUSE-SU-2013:0049","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html"},{"name":"USN-1681-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1681-1"},{"name":"openSUSE-SU-2013:0149","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html"},{"name":"USN-1681-2","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1681-2"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-01-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"Heap-based buffer overflow in the gfxTextRun::ShrinkToLigatureBoundaries function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-18T12:57:01.000Z","orgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","shortName":"mozilla"},"references":[{"name":"oval:org.mitre.oval:def:17019","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17019"},{"name":"SUSE-SU-2013:0048","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html"},{"name":"openSUSE-SU-2013:0131","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.mozilla.org/security/announce/2013/mfsa2013-02.html"},{"name":"USN-1681-4","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-1681-4"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=785555"},{"name":"SUSE-SU-2013:0049","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html"},{"name":"USN-1681-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-1681-1"},{"name":"openSUSE-SU-2013:0149","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html"},{"name":"USN-1681-2","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-1681-2"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@mozilla.org","ID":"CVE-2013-0771","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Heap-based buffer overflow in the gfxTextRun::ShrinkToLigatureBoundaries function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"oval:org.mitre.oval:def:17019","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17019"},{"name":"SUSE-SU-2013:0048","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html"},{"name":"openSUSE-SU-2013:0131","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00010.html"},{"name":"http://www.mozilla.org/security/announce/2013/mfsa2013-02.html","refsource":"CONFIRM","url":"http://www.mozilla.org/security/announce/2013/mfsa2013-02.html"},{"name":"USN-1681-4","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1681-4"},{"name":"https://bugzilla.mozilla.org/show_bug.cgi?id=785555","refsource":"CONFIRM","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=785555"},{"name":"SUSE-SU-2013:0049","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html"},{"name":"USN-1681-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1681-1"},{"name":"openSUSE-SU-2013:0149","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00017.html"},{"name":"USN-1681-2","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-1681-2"}]}}}},"cveMetadata":{"assignerOrgId":"f16b083a-5664-49f3-a51e-8d479e5ed7fe","assignerShortName":"mozilla","cveId":"CVE-2013-0771","datePublished":"2013-01-13T20:00:00.000Z","dateReserved":"2013-01-02T00:00:00.000Z","dateUpdated":"2024-08-06T14:41:47.077Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-01-13 20:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-787","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionEndExcluding":"18.0","matchCriteriaId":"B79F0682-C77C-4B65-B267-C370CFC70295"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0","versionEndExcluding":"10.0.12","matchCriteriaId":"BC13B81F-BA13-445C-9352-52C07DE5722C"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*","versionStartIncluding":"17.0","versionEndExcluding":"17.0.2","matchCriteriaId":"DBE1BFA6-20EE-44C2-8D48-17CAF2EE2D30"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*","versionEndExcluding":"2.15","matchCriteriaId":"1BA9E754-FE4D-4123-9FA8-E2AD38CC7320"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*","versionEndExcluding":"17.0.2","matchCriteriaId":"EAC3A76A-FEC9-461E-BA82-1D62DEB45B34"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0","versionEndExcluding":"10.0.12","matchCriteriaId":"D45B1950-19B6-4C22-8828-6C203FA4804C"},{"vulnerable":true,"criteria":"cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*","versionStartIncluding":"17.0","versionEndExcluding":"17.0.2","matchCriteriaId":"DCE07E1B-A9A5-44BC-98BB-A76B5F2EB133"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*","matchCriteriaId":"DE554781-1EB9-446E-911F-6C11970C47F4"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*","matchCriteriaId":"EBB2C482-D2A4-48B3-ACE7-E1DFDCC409B5"},{"vulnerable":true,"criteria":"cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*","matchCriteriaId":"D806A17E-B8F9-466D-807D-3F1E77603DC8"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:*","matchCriteriaId":"F0545634-EC4A-48E8-AB3D-49802FB11758"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*","matchCriteriaId":"00720D8C-3FF3-4B1C-B74B-91F01A544399"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:*","matchCriteriaId":"A53FF936-C785-4CEF-BAD0-3C3EB90EE466"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:*","matchCriteriaId":"88D6E858-FD8F-4C55-B7D5-CEEDA2BBA898"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:*","matchCriteriaId":"DB4D6749-81A1-41D7-BF4F-1C45A7F49A22"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:*","matchCriteriaId":"436EF2ED-FDBB-4B64-8EC4-33C3E4253F06"},{"vulnerable":true,"criteria":"cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:*","matchCriteriaId":"5AA37837-3083-4DC7-94F4-54FD5D7CB53C"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*","matchCriteriaId":"01EDA41C-6B2E-49AF-B503-EB3882265C11"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*","matchCriteriaId":"E4174F4F-149E-41A6-BBCC-D01114C05F38"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*","matchCriteriaId":"8D305F7A-D159-4716-AB26-5E38BB5CD991"},{"vulnerable":true,"criteria":"cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*","matchCriteriaId":"E2076871-2E80-4605-A470-A41C1A8EC7EE"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"771","Ordinal":"1","Title":"CVE-2013-0771","CVE":"CVE-2013-0771","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"771","Ordinal":"1","NoteData":"Heap-based buffer overflow in the gfxTextRun::ShrinkToLigatureBoundaries function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.","Type":"Description","Title":"CVE-2013-0771"},{"CveYear":"2013","CveId":"771","Ordinal":"2","NoteData":"2013-01-13","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"771","Ordinal":"3","NoteData":"2017-09-18","Type":"Other","Title":"Modified"}]}}}