CVE-2013-0791: canonical ubuntu_linux

Modified

AliasesDEBIAN-CVE-2013-0791

Published 03-04-2013Last modified 06-08-2024

Vulnerability summary

CVE-2013-0791 is a medium (CVSS 5.0) vulnerability in canonical ubuntu_linux. EPSS estimates a 5.21% chance of exploitation in the next 30 days, higher than 92.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

5.21%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 1

OPENSUSE-SU-2024:10451-1 RHSA-2013:1135 RHSA-2013:1144 RHSA-2013:1181

Timeline

03-04-2013
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted certificate.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

5.21%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.21% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Mozilla5 products

firefox≤ 20.0 | ≥ 17.0, < 17.0.5
network_security_services< 3.15
seamonkey< 2.17
thunderbird< 17.0.5
thunderbird_esr≥ 17.0, < 17.0.5

Redhat5 products

Canonical1 product

ubuntu_linuxEOL10.04 | 11.10 | 12.04 | 12.10

Debian1 product

nss< 2:3.14.3-1

Oracle1 product

vm_server3.2

5 vendors · 13 products

References

14 links

www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlX Refsource CONFIRMThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2013-05/msg00019.htmlVendor AdvisoryX Refsource SUSEBroken Link
www.ubuntu.com/usn/USN-1791-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17150VDB EntrySignatureX Refsource OVALBroken Link
lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.htmlVendor AdvisoryX Refsource SUSEBroken Link
rhn.redhat.com/errata/RHSA-2013-1135.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.mozilla.org/security/announce/2013/mfsa2013-40.htmlX Refsource CONFIRMVendor Advisory
www.securityfocus.com/bid/58826VDB EntryX Refsource BIDThird Party Advisory
rhn.redhat.com/errata/RHSA-2013-1144.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
kb.juniper.net/InfoCenter/index?page=content&id=JSA10761X Refsource CONFIRMThird Party Advisory

Show all 14 references

lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.htmlVendor AdvisoryX Refsource SUSEBroken Link
bugzilla.mozilla.org/show_bug.cgi?id=629816X Refsource CONFIRMIssue TrackingPatchVendor Advisory
lists.opensuse.org/opensuse-security-announce/2013-04/msg00013.htmlVendor AdvisoryX Refsource SUSEBroken Link
security-tracker.debian.org/tracker/CVE-2013-0791Advisory