Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-0791

The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted certificate.

Published

2013-04-03T11:56:21.117

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 5.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-119
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mozilla firefox ≤ 20.0 Yes
Application mozilla firefox < 17.0.5 Yes
Application mozilla network_security_services < 3.15 Yes
Application mozilla seamonkey < 2.17 Yes
Application mozilla thunderbird < 17.0.5 Yes
Application mozilla thunderbird_esr < 17.0.5 Yes
Operating System canonical ubuntu_linux 10.04 Yes
Operating System canonical ubuntu_linux 11.10 Yes
Operating System canonical ubuntu_linux 12.04 Yes
Operating System canonical ubuntu_linux 12.10 Yes
Application oracle vm_server 3.2 Yes
Operating System redhat enterprise_linux_desktop 5.0 Yes
Operating System redhat enterprise_linux_desktop 6.0 Yes
Operating System redhat enterprise_linux_eus 5.9 Yes
Operating System redhat enterprise_linux_server 5.0 Yes
Operating System redhat enterprise_linux_server 6.0 Yes
Operating System redhat enterprise_linux_server_aus 5.9 Yes
Operating System redhat enterprise_linux_workstation 5.0 Yes
Operating System redhat enterprise_linux_workstation 6.0 Yes
References