PT-2013-2618 · Mozilla+3 · Firefox+8

Ambroz Bizjak + 2 · Published 2013-04-03 · Updated 2024-10-21 · CVE-2013-0791

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 20.0 Firefox ESR 17.x versions prior to 17.0.5 Thunderbird versions prior to 17.0.5 Thunderbird ESR 17.x versions prior to 17.0.5 SeaMonkey versions prior to 2.17

Description The issue allows remote attackers to cause a denial of service, resulting in out-of-bounds read and memory corruption, via a crafted certificate. This is due to a problem in the CERT DecodeCertPackage function in Mozilla Network Security Services (NSS).

Recommendations For Mozilla Firefox versions prior to 20.0, update to version 20.0 or later. For Firefox ESR 17.x versions prior to 17.0.5, update to version 17.0.5 or later. For Thunderbird versions prior to 17.0.5, update to version 17.0.5 or later. For Thunderbird ESR 17.x versions prior to 17.0.5, update to version 17.0.5 or later. For SeaMonkey versions prior to 2.17, update to version 2.17 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CESA-2013_1144

CVE-2013-0791

OPENSUSE-SU-2013_0630-1

OPENSUSE-SU-2024:10451-1

RHSA-2013:1135

RHSA-2013:1144

RHSA-2013:1181

RHSA-2013_1135

RHSA-2013_1144

Affected Products

Centos

Firefox Esr

Firefox

Nss

Red Hat

Seamonkey

Suse

Thunderbird

Thunderbird Esr

References · 68

• http://ubuntu.com/usn/USN-1791-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-0791 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-0791 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2013-1144.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0791 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10451-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1620 · Security Note
• http://mozilla.org/security/announce/2013/mfsa2013-40.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1144.html · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=629816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0791 · Security Note