CVE-2013-1620: Canonical Ubuntu Linux

Medium severity, CVSS 4.3. EPSS: 3.7% chance of exploitation in the next 30 days.

The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.

Affected products

• Canonical Ubuntu Linux: version 10.04 only; version 11.10 only; version 12.04 only; version 12.10 only
• Mozilla Network Security Services: before 3.14.3 (fixed in 3.14.3)
• Oracle Enterprise Manager Ops Center: version 11.1 only; version 12.1 only; version 12.2 only
• Oracle Glassfish Communications Server: version 2.0 only
• Oracle Glassfish Server: version 2.1.1 only
• Oracle Iplanet Web Proxy Server: version 4.0 only
• Oracle Iplanet Web Server: version 6.1 only; version 7.0 only
• Oracle Opensso: version 3.0-03 only
• Oracle Traffic Director: version 11.1.1.6.0 only; version 11.1.1.7.0 only
• Oracle Vm Server: version 3.2 only
• Red Hat Enterprise Linux Desktop: version 5.0 only; version 6.0 only
• Red Hat Enterprise Linux Eus: version 5.9 only
• Red Hat Enterprise Linux Server: version 5.0 only; version 6.0 only
• Red Hat Enterprise Linux Server Aus: version 5.9 only
• Red Hat Enterprise Linux Workstation: version 5.0 only; version 6.0 only

Published 2013-02-08. Last modified 2026-06-16.