PatchTheCVECVE-2013-1055: The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which
CVE-2013-1055 is a medium-severity flaw (CVSS 4.3) affecting unity-firefox-extension, ubuntu linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox
Why this priority
- Public exploit reference
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 1.3% (top 30%) |
| CISA exploited list | No |
| Weakness | CWE-404 |
| Published | 2021-04-07 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2013-1055?
unity-firefox-extension: mitigate or apply the listed mitigation; ubuntu linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2013-1055 being exploited?
CVE-2013-1055 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2013-1055 affect?
CVE-2013-1055 affects unity-firefox-extension, ubuntu linux. Severity is medium (CVSS 4.3). The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with
How urgent is CVE-2013-1055?
Priority 43/100. Public exploit reference; On your watchlist
Software pages
Ubuntu vulnerabilities · Mozilla Firefox vulnerabilities · Unity vulnerabilities
Related CVEs
- CVE-2013-1054 MEDIUM 4.3 MITIGATE MITIGATE The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefo
- CVE-2012-0960 HIGH 7.5 UPGRADE Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callba
- CVE-2012-0958 MEDIUM 4.3 DOWNGRADE content/unity-api.js in the unity-firefox-extension extension 2.4.1 for Firefox exposes the toDataURL function