{"containers": {"cna": {"affected": [{"product": "unity-firefox-extension", "vendor": "Canonical", "versions": [{"lessThan": "3.0.0+14.04.20140416-0ubuntu1.14.04.1", "status": "affected", "version": "3.0.0", "versionType": "custom"}]}, {"product": "libunity-webapps", "vendor": "Canonical", "versions": [{"lessThan": "2.5.0~+14.04.20140409-0ubuntu1", "status": "affected", "version": "2.5.0", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Chris Coulson"}], "datePublic": "2013-05-02T00:00:00", "descriptions": [{"lang": "en", "value": "The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-404", "description": "CWE-404 Improper Resource Shutdown or Release", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-07T19:20:18", "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical"}, "references": [{"tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://ubuntu.com/USN-2743-3"}, {"tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "https://launchpad.net/bugs/1175691"}], "source": {"advisory": "https://ubuntu.com/USN-2743-3", "defect": ["https://launchpad.net/bugs/1175691"], "discovery": "INTERNAL"}, "title": "Potential DoS through abuse of rate limit in libunity-webapps for Firefox", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"AKA": "", "ASSIGNER": "security@ubuntu.com", "DATE_PUBLIC": "2013-05-02T17:20:00.000Z", "ID": "CVE-2013-1055", "STATE": "PUBLIC", "TITLE": "Potential DoS through abuse of rate limit in libunity-webapps for Firefox"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "unity-firefox-extension", "version": {"version_data": [{"platform": "", "version_affected": "<", "version_name": "3.0.0", "version_value": "3.0.0+14.04.20140416-0ubuntu1.14.04.1"}]}}, {"product_name": "libunity-webapps", "version": {"version_data": [{"platform": "", "version_affected": "<", "version_name": "2.5.0", "version_value": "2.5.0~+14.04.20140409-0ubuntu1"}]}}]}, "vendor_name": "Canonical"}]}}, "configuration": [], "credit": [{"lang": "eng", "value": "Chris Coulson"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package."}]}, "exploit": [], "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-404 Improper Resource Shutdown or Release"}]}]}, "references": {"reference_data": [{"name": "https://ubuntu.com/USN-2743-3", "refsource": "UBUNTU", "url": "https://ubuntu.com/USN-2743-3"}, {"name": "https://launchpad.net/bugs/1175691", "refsource": "UBUNTU", "url": "https://launchpad.net/bugs/1175691"}]}, "solution": [], "source": {"advisory": "https://ubuntu.com/USN-2743-3", "defect": ["https://launchpad.net/bugs/1175691"], "discovery": "INTERNAL"}, "work_around": []}}}, "cveMetadata": {"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "assignerShortName": "canonical", "cveId": "CVE-2013-1055", "datePublished": "2013-05-02T00:00:00", "dateReserved": "2013-01-11T00:00:00", "dateUpdated": "2021-04-07T19:20:18", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:canonical:unity-firefox-extension:*:*:*:*:*:*:*:*", "matchCriteriaId": "27466E15-3B63-4C12-B663-AB5A85179F7A", "versionEndExcluding": "3.0.0\\+14.04.20140416-0ubuntu1.14.04.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*", "matchCriteriaId": "815D70A8-47D3-459C-A32C-9FEACA0659D1", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*", "matchCriteriaId": "F38D3B7E-8429-473F-BB31-FC3583EE5A5B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package."}, {"lang": "es", "value": "El paquete unity-firefox-extension podr\u00eda ser enga\u00f1ado para que dejara caer una devoluci\u00f3n de llamada C que todav\u00eda estaba en uso, que luego Firefox liberar\u00eda, causando un bloqueo en Firefox.&#xa0;Esto podr\u00eda ser alcanzado al agregar una acci\u00f3n al iniciar y actualizar con nuevas devoluciones de llamada hasta que se alcance el l\u00edmite de frecuencia de libunity-webapps.&#xa0;Se corrigi\u00f3 en versiones 3.0.0+14.04.20140416-0ubuntu1.14.04.1 de unity-firefox-extension y en todas las versiones de libunity-webapps mediante el env\u00edo de un paquete de unity-firefox-extension vac\u00edo, deshabilitando as\u00ed la extensi\u00f3n por completo e invalidando el ataque contra el paquete libunity-webapps"}], "id": "CVE-2013-1055", "lastModified": "2021-04-20T19:21:11.393", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@ubuntu.com", "type": "Secondary"}]}, "published": "2021-04-07T20:15:13.090", "references": [{"source": "security@ubuntu.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://launchpad.net/bugs/1175691"}, {"source": "security@ubuntu.com", "tags": ["Vendor Advisory"], "url": "https://ubuntu.com/USN-2743-3"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-404"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}