CVE-2013-2004

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

The (1) GetDatabase and (2) _XimParseStringFile functions in X.org libX11 1.5.99.901 (1.6 RC1) and earlier do not restrict the recursion depth when processing directives to include files, which allows X servers to cause a denial of service (stack consumption) via a crafted file.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Jun 15, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-20056.8X.org libXt 1.1.3 and earlier does not check the return value of the XGetWindowProperty function, which allows X servers to trigger use of a CVE-2013-20062.1OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaint CVE-2013-20076.9The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which CVE-2013-20086.1WordPress Super Cache Plugin 1.3 has XSS.CVE-2013-20098.8WordPress WP Super Cache Plugin 1.2 has Remote PHP Code Execution CVE-2013-20109.8WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability CVE-2013-20118.8WordPress W3 Super Cache Plugin before 1.3.2 contains a PHP code-execution vulnerability which could allow remote attackers to inject arbitr CVE-2013-20127.3autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.CVE-2013-20132.1The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows loc CVE-2013-20145.0OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple CVE-2013-20154.7The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journa CVE-2013-20167.8A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device.