CVE-2013-2566
MediumThe RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
Published Mar 15, 2013 · Updated May 22, 2026
Key Facts
Patch immediately- CVE-2013-2566 is a medium-severity vulnerability (CVSS 5.9 v3.1) affecting Firefox (Mozilla), Seamonkey (Mozilla), Thunderbird (Mozilla) and 17 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 84% probability of exploitation in the next 30 days.
- Fixed versions are available, including M10-1 Firmware xcp2280, M10-4 Firmware xcp2280, M10-4s Firmware xcp2280.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
84%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2013-2566 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
Affected Products
29 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FirefoxMozilla | See advisory | 17.0.11 |
| SeamonkeyMozilla | See advisory | 2.22.1 |
| ThunderbirdMozilla | See advisory | 24.1.1 |
| Thunderbird EsrMozilla | See advisory | 17.0.11 |
| Communications Application Session ControllerOracle | See advisory | 3.9.1 |
Patched Releases
M10-1 Firmware
xcp2280
M10-4 Firmware
xcp2280
M10-4s Firmware
xcp2280
Sparc Enterprise M3000 Firmware
xcp_1121
Sparc Enterprise M4000 Firmware
xcp_1121
Sparc Enterprise M5000 Firmware
xcp_1121
Sparc Enterprise M8000 Firmware
xcp_1121
Sparc Enterprise M9000 Firmware
xcp_1121
Firefox
17.0.11
Seamonkey
2.22.1
Thunderbird
24.1.1
Thunderbird Esr
17.0.11
nss
3.53.1-3.el7_9+sp999
openssl
1:1.0.2k-25.el7_9+sp999, 1.0.1e-59.el6_10+sp999
Communications Application Session Controller
<=3.9.1
Integrated Lights Out Manager Firmware
<=3.2.11
seal-nss
3.53.1-3.el7_9+sp999
seal-openssl
1:1.0.2k-25.el7_9+sp999, 1.0.1e-59.el6_10+sp999
Timeline
Publicly disclosed
Mar 15, 2013
Last updated
May 22, 2026
Weakness Type
- CWE-326 Inadequate Encryption Strength
- CWE-327 Use of a Broken or Risky Cryptographic Algorithm
References
- advisoryhttp://blog.cryptographyengineering.com/2013/03/attack-of-week-rc4-is-kind-of-broken-in.html
- advisoryhttp://cr.yp.to/talks/2013.03.12/slides.pdf
- advisoryhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- advisoryHPSBGN03324
- advisoryhttp://my.opera.com/securitygroup/blog/2013/03/20/on-the-precariousness-of-rc4
FAQ
Common Questions.
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
Affected: Firefox (Mozilla); Seamonkey (Mozilla); Thunderbird (Mozilla), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including M10-1 Firmware xcp2280, M10-4 Firmware xcp2280, M10-4s Firmware xcp2280.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2013-2566 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo