CVE-2013-4365

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-10/msg00055.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-10/msg00059.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00024.htmlMailing List, Third Party Advisory
http://secunia.com/advisories/55197Third Party Advisory
http://svn.apache.org/viewvc?view=revision&revision=1527362Patch, Vendor Advisory
http://www.debian.org/security/2013/dsa-2778Third Party Advisory
http://www.mail-archive.com/dev%40httpd.apache.org/msg58077.html
http://www.securityfocus.com/bid/62939Third Party Advisory, VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-10/msg00055.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-10/msg00059.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2013-11/msg00024.htmlMailing List, Third Party Advisory
http://secunia.com/advisories/55197Third Party Advisory
http://svn.apache.org/viewvc?view=revision&revision=1527362Patch, Vendor Advisory
http://www.debian.org/security/2013/dsa-2778Third Party Advisory
http://www.mail-archive.com/dev%40httpd.apache.org/msg58077.html
http://www.securityfocus.com/bid/62939Third Party Advisory, VDB Entry

Timeline

Published: Oct 17, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-43669.8http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which CVE-2013-43677.8ovirt-engine 3.2 running on Linux kernel 3.1 and newer creates certain files world-writeable due to an upstream kernel change which impacted CVE-2013-43681.9The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variab CVE-2013-43691.9The xlu_vif_parse_rate function in the libxlu library in Xen 4.2.x and 4.3.x allows local users to cause a denial of service (NULL pointer d CVE-2013-43704.6The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which CVE-2013-43714.4Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under m CVE-2013-43724.3Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0 CVE-2013-43733.2The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network (JON) 3.1.2 allows local users to load arbitrary drift files CVE-2013-43747.1An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.CVE-2013-43752.7The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause CVE-2013-43767.5The setgid wrapper libx2go-server-db-sqlite3-wrapper.c in X2Go Server before 4.0.0.2 allows remote attackers to execute arbitrary code via u CVE-2013-43772.3Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (d