CVE-2013-0900 : Race condition in the International Components for Unicode (ICU) functionality i

Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Published 2013-02-23 21:55:02

Updated 2022-11-18 20:17:37

Source Google Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2013-0900

Debian » Debian Linux » Version: 6.0
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
Matching versions
Google » Chrome
Versions before (<) 25.0.1364.97
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A
Google » Chrome
Versions before (<) 25.0.1364.99
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2013-0900

EPSS FAQ

1.77%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 87 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-0900

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2013-0900

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-0900

http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html

Chrome Releases: Stable Channel Update
Release Notes;Vendor Advisory

CVEs referencing this url
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16404

Repository / Oval Repository
Third Party Advisory
http://www.debian.org/security/2013/dsa-2786

Debian -- Security Information -- DSA-2786-1 icu
Third Party Advisory

CVEs referencing this url
http://jvn.jp/en/jp/JVN70739377/index.html

JVN#70739377: Multiple products that use International Components for Unicode (ICU) vulnerable to denial-of-service (DoS)
Third Party Advisory;VDB Entry
https://code.google.com/p/chromium/issues/detail?id=152442

152442 - Heap-use-after-free in icu_46::RuleBasedCollator::RuleBasedCollator - chromium - Monorail
Exploit;Issue Tracking;Mailing List;Vendor Advisory
http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html

openSUSE-SU-2013:0454-1: moderate: chromium: updated to 27.0.1425
Broken Link;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2013-0900

Products affected by CVE-2013-0900

Exploit prediction scoring system (EPSS) score for CVE-2013-0900

CVSS scores for CVE-2013-0900

CWE ids for CVE-2013-0900

References for CVE-2013-0900