CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2013-1055 – Potential DoS through abuse of rate limit in libunity-webapps for Firefox
https://notcve.org/view.php?id=CVE-2013-1055
The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package. El paquete unity-firefox-extension podría ser engañado para que dejara caer una devolución de llamada C que todavía estaba en uso, que luego Firefox liberaría, causando un bloqueo en Firefox. Esto podría ser alcanzado al agregar una acción al iniciar y actualizar con nuevas devoluciones de llamada hasta que se alcance el límite de frecuencia de libunity-webapps. • https://launchpad.net/bugs/1175691 https://ubuntu.com/USN-2743-3 • CWE-404: Improper Resource Shutdown or Release •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 1CVE-2013-1054 – Possible remote DOS in WebApps
https://notcve.org/view.php?id=CVE-2013-1054
The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely. El paquete unity-firefox-extension podría ser engañado para destruir el contexto de las aplicaciones web de Unity, haciendo que Firefox se bloquee. Esto se puede lograr girando el bucle de eventos dentro de la devolución de llamada de inicialización de la aplicación web. • https://launchpad.net/bugs/1175661 https://ubuntu.com/USN-2743-3 • CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.5EPSS: 6%CPEs: 13EXPL: 0CVE-2012-0960
https://notcve.org/view.php?id=CVE-2012-0960
Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attackers to cause a denial of service (Firefox crash) and possibly execute arbitrary code via a crafted request. La integración de la extensión Unity (unity-firefox-extension) anterior a v2.4.1 para Firefox no maneja correctamente callbacks, lo que permite a atacantes remotos provocar una denegación de servicio (caída de Firefox) y posiblemente ejecutar código arbitrario a través de una solicitud especialmente creada • http://www.securityfocus.com/bid/56650 http://www.ubuntu.com/usn/USN-1639-1 https://bugs.launchpad.net/unity-firefox-extension/%2Bbug/1076350 https://exchange.xforce.ibmcloud.com/vulnerabilities/80319 • CWE-20: Improper Input Validation •