PT-2021-2656 · Canonical · Unity-Firefox-Extension

Chris Coulson + 3 · Published 2015-09-24 · Updated 2021-04-19 · CVE-2013-1054

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions unity-firefox-extension versions prior to 3.0.0+14.04.20140416-0ubuntu1.14.04.1

Description The issue is related to the unity-firefox-extension package, which could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. The problem is also associated with resource release errors.

Recommendations For versions prior to 3.0.0+14.04.20140416-0ubuntu1.14.04.1, update to version 3.0.0+14.04.20140416-0ubuntu1.14.04.1 or later, which ships an empty package and thus disables the extension entirely. As a temporary workaround, consider disabling the unity-firefox-extension to prevent potential crashes.

Exploit

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2021-02185

CVE-2013-1054

USN-2743-3

Affected Products

Unity-Firefox-Extension

References · 13

• 🔥 https://launchpad.net/bugs/1175661 · Exploit
• https://ubuntu.com/security/notices/USN-2743-3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02185 · Security Note
• https://ubuntu.com/security/CVE-2013-1054 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-1054 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1054 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-1054 · Security Note
• https://osv.dev/vulnerability/USN-2743-3 · Vendor Advisory
• https://ubuntu.com/USN-2743-3 · Vendor Advisory
• https://bugs.launchpad.net/ubuntu/+source/unity-firefox-extension/+bug/1175661 · Note
• https://t.me/cvenotify/13459 · Telegram Post
• https://launchpad.net/bugs/1069793 · Note
• https://launchpad.net/bugs/1498681 · Note