CVE-2013-0776

Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script, as demonstrated by a phishing attack on an HTTPS site.

Published: Feb 20, 2013
Updated: Apr 13, 2023
CVE: CVE-2013-0776
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4
AV:N/AC:H/Au:N/C:P/I:P/A:N

CWEs:

CWE-295

OWASP TOP 10:

A3 - Sensitive Data Exposure

Affected Software
References

Software	From	Fixed in
mozilla / thunderbird_esr	-	17.0.3
mozilla / thunderbird	-	17.0.3
mozilla / seamonkey	-	2.16
mozilla / firefox_esr	-	17.0.3
mozilla / firefox	-	19.0
opensuse / opensuse	11.4	11.4.x
opensuse / opensuse	12.2	12.2.x
opensuse / opensuse	12.1	12.1.x
redhat / enterprise_linux_server	5.0	5.0.x
redhat / enterprise_linux_workstation	5.0	5.0.x
redhat / enterprise_linux_desktop	6.0	6.0.x
redhat / enterprise_linux_server	6.0	6.0.x
redhat / enterprise_linux_workstation	6.0	6.0.x
redhat / enterprise_linux_desktop	5.0	5.0.x
redhat / enterprise_linux_aus	5.9	5.9.x
redhat / enterprise_linux_eus	6.3	6.3.x
redhat / enterprise_linux_eus	5.9	5.9.x
debian / debian_linux	7.0	7.0.x
canonical / ubuntu_linux	11.10	11.10.x
canonical / ubuntu_linux	12.10	12.10.x
canonical / ubuntu_linux	12.04	12.04.x
canonical / ubuntu_linux	10.04	10.04.x

Vulnerability Database

CVE-2013-0776

Deep Security Visibility Without the Complexity