CVE-2013-5605: mozilla network_security_services Improper Input Validation

CVSS: 7.5v2.0HighModified

AliasesRHSA-2013:1840RHSA-2013:1841DEBIAN-CVE-2013-5605+1 more

Published 16-11-2013Last modified 06-08-2024

Vulnerability summary

CVE-2013-5605 is a high (CVSS 7.5) Improper Input Validation vulnerability in mozilla network_security_services. EPSS estimates a 4.44% chance of exploitation in the next 30 days, higher than 91.2% of scored vulnerabilities.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

4.44%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 5 · Related 1

MGASA-2013-0337 OPENSUSE-SU-2024:10451-1 RHSA-2013:1791 RHSA-2013:1829 RHSA-2014:0041

Timeline

16-11-2013
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

4.44%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.44% on 18-09-2026

18-09-202618-10-2026

EPSS score

4.44%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Redhat6 products

nss< 0:3.13.1-9.el6_2 | < 0:3.13.6-3.el6_3 | < 0:3.14.3-5.el6_4 | < 0:3.12.3.99.3-3.el5_3 | < 0:3.12.8-8.el5_6 | < 0:3.14.3-8.el5_9
nss-debuginfo< 0:3.13.1-9.el6_2 | < 0:3.13.6-3.el6_3 | < 0:3.14.3-5.el6_4 | < 0:3.12.3.99.3-3.el5_3 | < 0:3.12.8-8.el5_6 | < 0:3.14.3-8.el5_9
nss-devel< 0:3.13.1-9.el6_2 | < 0:3.13.6-3.el6_3 | < 0:3.14.3-5.el6_4 | < 0:3.12.3.99.3-3.el5_3 | < 0:3.12.8-8.el5_6 | < 0:3.14.3-8.el5_9
nss-pkcs11-devel< 0:3.13.1-9.el6_2 | < 0:3.13.6-3.el6_3 | < 0:3.14.3-5.el6_4 | < 0:3.12.3.99.3-3.el5_3 | < 0:3.12.8-8.el5_6 | < 0:3.14.3-8.el5_9
nss-sysinit< 0:3.13.1-9.el6_2 | < 0:3.13.6-3.el6_3 | < 0:3.14.3-5.el6_4

Show all 6

Debian1 product

nss< 2:3.15.3-1 | < 3.12.8-1+squeeze7 | < 2:3.14.5-1

Mozilla1 product

network_security_services3.14 | 3.14.1 | 3.14.2 | 3.14.3 | 3.14.4 | 3.15 | 3.15.1 | 3.15.2

3 vendors · 8 products

References

38 links

www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlX Refsource CONFIRM
rhn.redhat.com/errata/RHSA-2013-1840.htmlVendor AdvisoryX Refsource REDHAT
developer.mozilla.org/docs/NSS/NSS_3.15.3_release_notesX Refsource CONFIRMPatch
bugzilla.mozilla.org/show_bug.cgi?id=934016X Refsource CONFIRM
www.vmware.com/security/advisories/VMSA-2014-0012.htmlX Refsource CONFIRM
www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlX Refsource CONFIRM
rhn.redhat.com/errata/RHSA-2013-1841.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/archive/1/534161/100/0/threadedMailing ListX Refsource BUGTRAQ
lists.opensuse.org/opensuse-updates/2013-11/msg00078.htmlVendor AdvisoryX Refsource SUSE
www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlX Refsource CONFIRM

Show all 38 references

security.gentoo.org/glsa/201504-01Vendor AdvisoryX Refsource GENTOO
security.gentoo.org/glsa/glsa-201406-19.xmlVendor AdvisoryX Refsource GENTOO
www.ubuntu.com/usn/USN-2030-1Vendor AdvisoryX Refsource UBUNTU
www.ubuntu.com/usn/USN-2031-1Vendor AdvisoryX Refsource UBUNTU
www.ubuntu.com/usn/USN-2032-1Vendor AdvisoryX Refsource UBUNTU
rhn.redhat.com/errata/RHSA-2013-1791.htmlVendor AdvisoryX Refsource REDHAT
developer.mozilla.org/docs/NSS/NSS_3.14.5_release_notesX Refsource CONFIRMPatch
www.oracle.com/technetwork/topics/security/cpujul2014-1972956.htmlX Refsource CONFIRM
lists.opensuse.org/opensuse-security-announce/2013-12/msg00000.htmlVendor AdvisoryX Refsource SUSE
kb.juniper.net/InfoCenter/index?page=content&id=JSA10761X Refsource CONFIRM
seclists.org/fulldisclosure/2014/Dec/23Mailing ListX Refsource FULLDISC
www.debian.org/security/2013/dsa-2800Vendor AdvisoryX Refsource DEBIAN
www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.htmlX Refsource CONFIRM
www.securityfocus.com/bid/63738VDB EntryX Refsource BID
www.mozilla.org/security/announce/2013/mfsa2013-103.htmlX Refsource CONFIRM
lists.opensuse.org/opensuse-updates/2013-11/msg00080.htmlVendor AdvisoryX Refsource SUSE
rhn.redhat.com/errata/RHSA-2014-0041.htmlVendor AdvisoryX Refsource REDHAT
rhn.redhat.com/errata/RHSA-2013-1829.htmlVendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2013:1840Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1030807REPORT
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1840.jsonAdvisory
access.redhat.com/security/cve/CVE-2013-5605REPORT
www.cve.org/CVERecord?id=CVE-2013-5605Advisory
nvd.nist.gov/vuln/detail/CVE-2013-5605Advisory
access.redhat.com/errata/RHSA-2013:1841Advisory
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1841.jsonAdvisory
security-tracker.debian.org/tracker/CVE-2013-5605Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities