CVE-2013-1620: canonical ubuntu_linux Observable Discrepancy
Vulnerability summary
CVE-2013-1620 is a medium (CVSS 4.3) Observable Discrepancy vulnerability in canonical ubuntu_linux. EPSS estimates a 3.72% chance of exploitation in the next 30 days, higher than 89.8% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 4 · Related 1Timeline
- 08-02-2013PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.72%
Chance of exploitation in the next 30 days
Percentile
90%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.72% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Oracle8 products
- enterprise_manager_ops_center11.1 | 12.1 | 12.2
- glassfish_communications_server2.0
- glassfish_server2.1.1
- iplanet_web_proxy_server4.0
- iplanet_web_server6.1 | 7.0
Redhat5 products
- enterprise_linux_desktop5.0 | 6.0
- enterprise_linux_eus5.9
- enterprise_linux_server5.0 | 6.0
- enterprise_linux_server_aus5.9
- enterprise_linux_workstation5.0 | 6.0
Canonical1 product
- ubuntu_linuxEOL10.04 | 11.10 | 12.04 | 12.10
Debian1 product
- nss< 2:3.14.3-1
Mozilla1 product
- network_security_services< 3.14.3
5 vendors · 16 products
References
20 links- www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlX Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.htmlVendor AdvisoryX Refsource SUSEBroken Link
- www.securityfocus.com/archive/1/534161/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
- www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlX Refsource CONFIRMThird Party Advisory
Show all 20 references
- www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.htmlX Refsource CONFIRMThird Party Advisory
- www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlX Refsource CONFIRMThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2013-04/msg00010.htmlVendor AdvisoryX Refsource SUSEBroken Link
- www.oracle.com/technetwork/topics/security/cpujan2014-1972949.htmlX Refsource CONFIRMThird Party Advisory
