PT-2021-2655 · Mozilla+1 · Firefox+2

Chris Coulson + 3 · Published 2015-09-24 · Updated 2021-04-20 · CVE-2013-1055

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions unity-firefox-extension versions prior to 3.0.0+14.04.20140416-0ubuntu1.14.04.1

Description The issue is related to resource release errors in the unity-firefox-extension package. It can be exploited by a remote attacker to cause a denial of service. The exploitation involves tricking the package into dropping a C callback that is still in use, leading to a crash when Firefox attempts to free it. This can be achieved by adding an action to the launcher and updating it with new callbacks until a rate limit is hit.

Recommendations For versions prior to 3.0.0+14.04.20140416-0ubuntu1.14.04.1, update to version 3.0.0+14.04.20140416-0ubuntu1.14.04.1 or later of unity-firefox-extension to resolve the issue. Alternatively, consider disabling the unity-firefox-extension package entirely, as done in the fixed versions of libunity-webapps, to prevent the attack.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2021-02184

CVE-2013-1055

USN-2743-3

Affected Products

Firefox

Libunity-Webapps

Unity-Firefox-Extension

References · 11

• 🔥 https://launchpad.net/bugs/1175691 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1055 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-1055 · Security Note
• https://ubuntu.com/security/CVE-2013-1055 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-1055 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2743-3 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2743-3 · Vendor Advisory
• https://ubuntu.com/USN-2743-3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02184 · Security Note
• https://launchpad.net/bugs/1069793 · Note
• https://launchpad.net/bugs/1498681 · Note