CVE-2013-1054

The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://launchpad.net/bugs/1175661	Exploit Vendor Advisory
https://ubuntu.com/USN-2743-3	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:canonical:unity-firefox-extension:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
	cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::*

History

19 Apr 2021, 16:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 4.3 v3 : 6.5
References	~~(UBUNTU) https://launchpad.net/bugs/1175661 -~~	(UBUNTU) https://launchpad.net/bugs/1175661 - Exploit, Vendor Advisory
References	~~(UBUNTU) https://ubuntu.com/USN-2743-3 -~~	(UBUNTU) https://ubuntu.com/USN-2743-3 - Vendor Advisory
CWE		CWE-404
CPE		cpe:2.3:o:canonical:ubuntu_linux:15.04:::::::* cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm::: cpe:2.3:a:canonical:unity-firefox-extension::::::::

07 Apr 2021, 20:30

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-04-07 20:15

Updated : 2023-12-10 13:55

NVD link : CVE-2013-1054

Mitre link : CVE-2013-1054

CVE.ORG link : CVE-2013-1054

JSON object : View

Products Affected

canonical

unity-firefox-extension
ubuntu_linux

CWE

CWE-404

Improper Resource Shutdown or Release

{"id": "CVE-2013-1054", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2021-04-07T20:15:12.870", "references": [{"url": "https://launchpad.net/bugs/1175661", "tags": ["Exploit", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://ubuntu.com/USN-2743-3", "tags": ["Vendor Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-404"}]}, {"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-404"}]}], "descriptions": [{"lang": "en", "value": "The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely."}, {"lang": "es", "value": "El paquete unity-firefox-extension podr\u00eda ser enga\u00f1ado para destruir el contexto de las aplicaciones web de Unity, haciendo que Firefox se bloquee. Esto se puede lograr girando el bucle de eventos dentro de la devoluci\u00f3n de llamada de inicializaci\u00f3n de la aplicaci\u00f3n web. Se corrigi\u00f3 en 3.0.0+14.04.20140416-0ubuntu1.14.04.1 al enviar un paquete vac\u00edo, deshabilitando as\u00ed la extensi\u00f3n por completo"}], "lastModified": "2021-04-19T16:17:23.920", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:unity-firefox-extension:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27466E15-3B63-4C12-B663-AB5A85179F7A", "versionEndExcluding": "3.0.0\\+14.04.20140416-0ubuntu1.14.04.1"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*", "vulnerable": true, "matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F38D3B7E-8429-473F-BB31-FC3583EE5A5B"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}