VDB
CVE-2013-2179
CVE-2013-2179
PUBLISHED
CVSS 4.300000190734863 MEDIUM
X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by attempting to log into an account whose password field contains invalid characters, as demonstrated using the crypt function from glibc 2.17 and later with (1) the "!" character in the salt portion of a password field or (2) a password that has been encrypted using DES or MD5 in FIPS-140 mode.
EPSS 2.44% · 84.1th percentile
Risk Scores
CVSS 2.0
4.300000190734863
EPSS Score
2.44%
84.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| x | x_display_manager | 1.1.10, 1.1.11 |
| n/a | n/a | n/a |
Timeline
- Dec 27, 2013 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
- May 28, 2023 EPSS Score
- Jul 20, 2023 EPSS Score
References
- openSUSE-SU-2013:1117 vendor-advisory
- [oss-security] 20130613 Re: CVE request for possible NULL ptr deref in XDM when using crypt() from glibc 2.17+ mailing-list
- https://bugs.mageia.org/show_bug.cgi?id=10682 url
- http://cgit.freedesktop.org/xorg/app/xdm/commit/?id=8d1eb5c74413e4c9a21f689fc106949b121c0117 url
- https://nvd.nist.gov/vuln/detail/CVE-2013-2179 advisory