CVE-2013-1055

Potential DoS through abuse of rate limit in libunity-webapps for Firefox

State
Published
Severity
4.3 Medium
Published
Apr 7, 2021
Updated
Sep 16, 2024
Reserved
Jan 11, 2013

Read the record on cve.org

Description

The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:Lcanonical

Weaknesses

  • CWE-404 Improper Resource Shutdown or Release

Affected Products

ProductVersions
unity-firefox-extensionCanonical
  • 3.0.0 to before 3.0.0+14.04.20140416-0ubuntu1.14.04.1Affected
libunity-webappsCanonical
  • 2.5.0 to before 2.5.0~+14.04.20140409-0ubuntu1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.