Possible remote DOS in WebApps
Priority LOW 32CWE-404Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-404.
Summary
The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely.
Why it matters now
EPSS 0.01341 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed unity-firefox-extension (Canonical): 3.0.0+14.04.20140416-0ubuntu1.14.04.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canonical | unity-firefox-extension | 3.0.0 to before 3.0.0+14.04.20140416-0ubuntu1.14.04.1 | 3.0.0+14.04.20140416-0ubuntu1.14.04.1 | Patch available | CNA |
- unity-firefox-extension VendorCanonical Affected 3.0.0 to before 3.0.0+14.04.20140416-0ubuntu1.14.04.1 Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 Patch available CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:canonical:unity-firefox-extension:*:*:*:*:*:*:*:* | before 3.0.0\+14.04.20140416-0ubuntu1.14.04.1 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | 14.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* | 15.04 | Vulnerable | Canonical |
- cpe:2.3:a:canonical:unity-firefox-extension:*:*:*:*:*:*:*:* Versions before 3.0.0\+14.04.20140416-0ubuntu1.14.04.1 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:* Versions 15.04 Vulnerable ·Canonical
Remediation
- Fix · CNA unity-firefox-extension (Canonical) Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Canonical unity-firefox-extension — ubuntu.com/USN-2743-3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2013-00917 Potential DoS through abuse of rate limit in libunity-webapps for FirefoxPriority LOW 23
Timeline
- 2026-10-02 Threatist record created from CVE-2013-1054
- 2026-10-03 Alias added: GHSA-jh4r-88h5-574v
References
Exploit 1
Advisory 1
More Canonical Ubuntu Linux vulnerabilities
- TI-2020-09349 An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. KEVCVSS 3.1CRITICAL 9.8
- TI-2020-05854 smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other… KEVCVSS 3.1CRITICAL 9.8
- TI-2020-01431 Netlogon Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2019-12627 Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than… KEVCVSS 3.1CRITICAL 9.8
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-07471 OS command injection in exim KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2013-1054 · CVE Program
- CVE-2013-1054 · NVD
- FIRST EPSS
- GHSA-jh4r-88h5-574v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences