CVE-2013-4394

MediumCVSS 5.9/10Last modified Jun 16, 2026

Description

The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain privileges via vectors involving "special and control characters."

Metrics

CVSS 2.0 5.9/10AV:L/AC:H/Au:N/C:C/I:C/A:P

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357Issue Tracking, Third Party Advisory
http://www.debian.org/security/2013/dsa-2777Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/10/01/9Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=862324Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201612-34Third Party Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357Issue Tracking, Third Party Advisory
http://www.debian.org/security/2013/dsa-2777Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/10/01/9Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=862324Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201612-34Third Party Advisory

Timeline

Published: Oct 28, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-43956.1Simple Machines Forum (SMF) through 2.0.5 has XSS CVE-2013-43966.5Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remot CVE-2013-43976.8Multiple integer overflows in the th_read function in lib/block.c in libtar before 1.2.20 allow remote attackers to cause a denial of servic CVE-2013-43994.3The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes eve CVE-2013-44007.2virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local users to overwrite arbitrary files and possibly gain privileges via unspecified CVE-2013-44018.5The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:wr CVE-2013-44025.0The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infi CVE-2013-44046.5cumin in Red Hat Enterprise MRG Grid 2.4 does not properly enforce user roles, which allows remote authenticated users to bypass intended ro CVE-2013-44056.8Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allow remote at CVE-2013-44065.0The Quick Tabs module 6.x-2.x before 6.x-2.2, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.6 for Drupal does not properly check block pe CVE-2013-44076.8HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the CVE-2013-44088.3Heap-based buffer overflow in the dcerpc_read_ncacn_packet_done function in librpc/rpc/dcerpc_util.c in winbindd in Samba 3.x before 3.6.22,