Canonical Unity-Firefox-Extension vulnerabilities

2 CVEs affecting Canonical Unity-Firefox-Extension, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-1055, published 2021-04-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-1054, published 2021-04-07. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. The unity-firefox-extension package could be tricked into destroying the Unity webapps context, causing Firefox to crash. This could be achieved by spinning the event loop inside the webapps…
CVE-2013-1055, published 2021-04-07. Medium severity, CVSS 4.3. EPSS: 1.3% chance of exploitation in the next 30 days. The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an…