CVE-2013-1055
Potential DoS through abuse of rate limit in libunity-webapps for Firefox
- State
- Published
- Severity
- 4.3 Medium
- Published
- Apr 7, 2021
- Updated
- Sep 16, 2024
- Reserved
- Jan 11, 2013
Description
The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L | canonical |
Weaknesses
- CWE-404 Improper Resource Shutdown or Release
Affected Products
| Product | Versions |
|---|---|
unity-firefox-extensionCanonical |
|
libunity-webappsCanonical |
|
References
- https://ubuntu.com/USN-2743-3vendor-advisory
- https://launchpad.net/bugs/1175691vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.