CVE-2013-1055
CVSS V2 Medium 4.3
CVSS V3 Medium 4.3
Description
The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package.
Overview
- CVE ID
- CVE-2013-1055
- Assigner
- security@ubuntu.com
- Vulnerability Status
- Analyzed
- Published Version
- 2021-04-07T20:15:13
- Last Modified Date
- 2021-04-20T19:21:11
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:canonical:unity-firefox-extension:*:*:*:*:*:*:*:* | 1 | OR | 3.0.0\+14.04.20140416-0ubuntu1.14.04.1 | |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 1 | OR | ||
| cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:N/I:N/A:P
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- NONE
- Integrity Impact
- NONE
- Availability Impact
- PARTIAL
- Base Score
- 4.3
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality Impact
- NONE
- Availability Impact
- LOW
- Base Score
- 4.3
- Base Severity
- MEDIUM
- Exploitability Score
- 2.8
- Impact Score
- 1.4
References
| Reference URL | Reference Tags |
|---|---|
| https://ubuntu.com/USN-2743-3 | Vendor Advisory |
| https://launchpad.net/bugs/1175691 | Exploit Vendor Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2013-1055 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1055 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 07:15:08 | Added to TrackCVE | |||
| 2022-12-06 01:23:33 | 2021-04-07T20:15Z | 2021-04-07T20:15:13 | CVE Published Date | updated |
| 2022-12-06 01:23:33 | 2021-04-20T19:21:11 | CVE Modified Date | updated | |
| 2022-12-06 01:23:33 | Analyzed | Vulnerability Status | updated |