CVE-2013-1054

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps initialization callback. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 by shipping an empty package, thus disabling the extension entirely.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404

Affected software

VendorProductVersions
Canonicalunity-firefox-extension>= 3.0.0, < 3.0.0+14.04.20140416-0ubuntu1.14.04.1

References

Timeline

Published
Apr 7, 2021
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-10554.3The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causiCVE-2013-10561.9X.org X server 1.13.3 and earlier, when not run as root, allows local users to cause a denial of service (crash) or possibly gain privilegesCVE-2013-10574.4Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan CVE-2013-10585.8maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these CVE-2013-10597.8net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and sysCVE-2013-10606.9A certain Ubuntu build procedure for perf, as distributed in the Linux kernel packages in Ubuntu 10.04 LTS, 12.04 LTS, 12.10, 13.04, and 13.CVE-2013-10614.6dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not CVE-2013-10624.6ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication witCVE-2013-10634.6usb-creator 0.2.47 before 0.2.47.1, 0.2.40 before 0.2.40ubuntu2, and 0.2.38 before 0.2.38.2 does not properly use D-Bus for communication wiCVE-2013-10644.6apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authoritCVE-2013-10654.6backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local userCVE-2013-10664.6language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not properly use D-Bus for communication with
CVE-2013-1054: Medium severity, CVSS 6.5 | Vulnix