CVE-2013-5607

nspr: Avoid unsigned integer wrapping in PL_ArenaAllocate (MFSA 2013-103)

Published Nov 20, 2013 CVSS 2.0 · 7.5 High EPSS 3.0% KEV · Not listed
Description
Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-2820-1 nspr security update
EUVD EUVD EUVD-2013-5447 Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741.
Ubuntu USN Ubuntu USN USN-2031-1 Firefox vulnerabilities
Ubuntu USN Ubuntu USN USN-2032-1 Thunderbird vulnerabilities
Ubuntu USN Ubuntu USN USN-2087-1 NSPR vulnerability
History
Type Values Removed Values Added
CPEs cpe:2.3:a:mozilla:firefox_esr:24.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:24.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:24.0.2:*:*:*:*:*:*:*
Vendors & Products Mozilla firefox Esr
Type Values Removed Values Added
CPEs cpe:2.3:a:mozilla:firefox_esr:17.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:17.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:24.0:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0:*:*:*:*:*:*:*
Type Values Removed Values Added
CPEs cpe:2.3:a:mozilla:firefox_esr:17.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:17.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:17.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:17.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:17.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:17.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:17.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:17.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:17.0.9:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.5:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.6:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.7:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.8:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:17.0.9:*:*:*:*:*:*:*
Weaknesses

Sources

Status
PUBLISHED
Assigner
mozilla
Published
Updated
Aug 6, 2024, 5:15 PM
Reserved
Aug 26, 2013, 12:00 AM
Status
Modified
Published
Nov 20, 2013, 2:12 PM
Modified
Jun 16, 2026, 11:59 PM
Severity
Moderate
Public date
Nov 19, 2013, 12:00 AM