CVE-2013-1620
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider...
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Exploit likelihood
What each source reports
NVD Score used
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
- Record
CVE-2013-1620- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
CVE List No score
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
- Record
CVE-2013-1620- Updated
- 2026-11-02
EUVDEUVD-2013-1655 No score
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
- Record
EUVD-2013-1655- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4pp6-m86c-j4gj No score
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider...
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
- Record
GHSA-4pp6-m86c-j4gj- Weakness
- CWE-203
- Updated
- 2026-11-02
OSV No score
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
- Record
CVE-2013-1620- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1620 No score
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
- Record
DEBIAN-CVE-2013-1620- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10451-1 No score
libfreebl3-3.26.2-1.1 on GA media
These are all security issues fixed in the libfreebl3-3.26.2-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10451-1- Updated
- 2026-11-02
Affected products
- mozilla network security services
- canonical ubuntu linux
- oracle enterprise manager ops center
- oracle glassfish communications server
- oracle glassfish server
- oracle iplanet web proxy server
- oracle iplanet web server
- oracle opensso
- oracle traffic director
- oracle vm server
- redhat enterprise linux desktop
- redhat enterprise linux eus
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nssDebian:12 |
before 2:3.14.3-1 | 2:3.14.3-1 |
nssDebian:13 |
before 2:3.14.3-1 | 2:3.14.3-1 |
nssDebian:14 |
before 2:3.14.3-1 | 2:3.14.3-1 |
nsprRed Hat:enterprise_linux:5::server |
before 0:4.9.5-1.el5_9 | 0:4.9.5-1.el5_9 |
nspr-debuginfoRed Hat:enterprise_linux:5::server |
before 0:4.9.5-1.el5_9 | 0:4.9.5-1.el5_9 |
nspr-develRed Hat:enterprise_linux:5::server |
before 0:4.9.5-1.el5_9 | 0:4.9.5-1.el5_9 |
nssRed Hat:enterprise_linux:5::server |
before 0:3.14.3-6.el5_9 | 0:3.14.3-6.el5_9 |
nss-debuginfoRed Hat:enterprise_linux:5::server |
before 0:3.14.3-6.el5_9 | 0:3.14.3-6.el5_9 |
nss-develRed Hat:enterprise_linux:5::server |
before 0:3.14.3-6.el5_9 | 0:3.14.3-6.el5_9 |
nss-pkcs11-develRed Hat:enterprise_linux:5::server |
before 0:3.14.3-6.el5_9 | 0:3.14.3-6.el5_9 |
Show 71 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nss-toolsRed Hat:enterprise_linux:5::server |
before 0:3.14.3-6.el5_9 | 0:3.14.3-6.el5_9 |
nsprRed Hat:enterprise_linux:6::client |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nspr-debuginfoRed Hat:enterprise_linux:6::client |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nssRed Hat:enterprise_linux:6::client |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-debuginfoRed Hat:enterprise_linux:6::client |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-softoknRed Hat:enterprise_linux:6::client |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-debuginfoRed Hat:enterprise_linux:6::client |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-freeblRed Hat:enterprise_linux:6::client |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-sysinitRed Hat:enterprise_linux:6::client |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-toolsRed Hat:enterprise_linux:6::client |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-utilRed Hat:enterprise_linux:6::client |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-util-debuginfoRed Hat:enterprise_linux:6::client |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nspr-develRed Hat:enterprise_linux:6::client |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nss-develRed Hat:enterprise_linux:6::client |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-pkcs11-develRed Hat:enterprise_linux:6::client |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-softokn-develRed Hat:enterprise_linux:6::client |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-freebl-develRed Hat:enterprise_linux:6::client |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-util-develRed Hat:enterprise_linux:6::client |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nsprRed Hat:enterprise_linux:6::computenode |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nspr-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nssRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-softoknRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-freeblRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-sysinitRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-toolsRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-utilRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-util-debuginfoRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nspr-develRed Hat:enterprise_linux:6::computenode |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nss-develRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-pkcs11-develRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-softokn-develRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-freebl-develRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-util-develRed Hat:enterprise_linux:6::computenode |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nsprRed Hat:enterprise_linux:6::server |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nspr-debuginfoRed Hat:enterprise_linux:6::server |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nspr-develRed Hat:enterprise_linux:6::server |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nssRed Hat:enterprise_linux:6::server |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-develRed Hat:enterprise_linux:6::server |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-softoknRed Hat:enterprise_linux:6::server |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-develRed Hat:enterprise_linux:6::server |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-freeblRed Hat:enterprise_linux:6::server |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-freebl-develRed Hat:enterprise_linux:6::server |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-sysinitRed Hat:enterprise_linux:6::server |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-toolsRed Hat:enterprise_linux:6::server |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-utilRed Hat:enterprise_linux:6::server |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-util-debuginfoRed Hat:enterprise_linux:6::server |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-util-develRed Hat:enterprise_linux:6::server |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-pkcs11-develRed Hat:enterprise_linux:6::server |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nsprRed Hat:enterprise_linux:6::workstation |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nspr-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nspr-develRed Hat:enterprise_linux:6::workstation |
before 0:4.9.5-2.el6_4 | 0:4.9.5-2.el6_4 |
nssRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-develRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-softoknRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-develRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-freeblRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-softokn-freebl-develRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-sysinitRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-toolsRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
nss-utilRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-util-debuginfoRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-util-develRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-3.el6_4 | 0:3.14.3-3.el6_4 |
nss-pkcs11-develRed Hat:enterprise_linux:6::workstation |
before 0:3.14.3-4.el6_4 | 0:3.14.3-4.el6_4 |
rhev-hypervisor6Red Hat:enterprise_linux:6::hypervisor |
before 0:6.4-20130815.0.el6_4 | 0:6.4-20130815.0.el6_4 |
mozilla-nssopenSUSE:Tumbleweed |
before 3.26.2-1.1 | 3.26.2-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1620 is a medium vulnerability (CVSS 4.3) in Mozilla Network Security Services, published February 8, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.72%, the 89th percentile. Fixed in nss 2:3.14.3-1.
References
oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
securityfocus.com/bid/57777
vmware.com/security/advisories/VMSA-2014-0012.html
isg.rhul.ac.uk/tls/TLStiming.pdf
lists.opensuse.org/opensuse-security-announce/2013-04/msg00009.html
openwall.com/lists/oss-security/2013/02/05/24
Show 73 moreShow less
ubuntu.com/usn/USN-1763-1
security.gentoo.org/glsa/glsa-201406-19.xml
rhn.redhat.com/errata/RHSA-2013-1135.html
kb.juniper.net/InfoCenter/index?page=content&id=JSA10761
seclists.org/fulldisclosure/2014/Dec/23
nvd.nist.gov/vuln/detail/CVE-2013-1620
github.com/advisories/GHSA-4pp6-m86c-j4gj
security-tracker.debian.org/tracker/CVE-2013-1620
access.redhat.com/errata/RHSA-2013:1135
bugzilla.redhat.com/show_bug.cgi?id=908234
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1135.json
cve.org/CVERecord?id=CVE-2013-0791
mozilla.org/security/announce/2013/mfsa2013-40.html
suse.com/security/cve/CVE-2010-3170