CVE ID:	CVE-2013-1697
Description:	The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
Test IDs:	1.3.6.1.4.1.25623.1.2.1.2013.59
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1697 BugTraq ID: 60784 http://www.securityfocus.com/bid/60784 Debian Security Information: DSA-2716 (Google Search) http://www.debian.org/security/2013/dsa-2716 Debian Security Information: DSA-2720 (Google Search) http://www.debian.org/security/2013/dsa-2720 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17243 RedHat Security Advisories: RHSA-2013:0981 http://rhn.redhat.com/errata/RHSA-2013-0981.html RedHat Security Advisories: RHSA-2013:0982 http://rhn.redhat.com/errata/RHSA-2013-0982.html SuSE Security Announcement: SUSE-SU-2013:1152 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00010.html SuSE Security Announcement: SUSE-SU-2013:1153 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00011.html SuSE Security Announcement: openSUSE-SU-2013:1140 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00003.html SuSE Security Announcement: openSUSE-SU-2013:1141 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00004.html SuSE Security Announcement: openSUSE-SU-2013:1142 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00005.html SuSE Security Announcement: openSUSE-SU-2013:1143 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00006.html http://www.ubuntu.com/usn/USN-1890-1 http://www.ubuntu.com/usn/USN-1891-1