CVE-2013-4412

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

slim has NULL pointer dereference when using crypt() method from glibc 2.17

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
slim	slim	< 1.3.6

References

http://www.openwall.com/lists/oss-security/2013/10/09/6Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/62906Third Party Advisory, VDB Entry
https://access.redhat.com/security/cve/cve-2013-4412Broken Link, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4412Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/89675Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-4412Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/10/09/6Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/62906Third Party Advisory, VDB Entry
https://access.redhat.com/security/cve/cve-2013-4412Broken Link, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4412Issue Tracking, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/89675Third Party Advisory, VDB Entry
https://security-tracker.debian.org/tracker/CVE-2013-4412Third Party Advisory

Timeline

Published: Nov 4, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-44135.0Directory traversal vulnerability in controller/concerns/render_redirect.rb in the Wicked gem before 1.0.1 for Ruby allows remote attackers CVE-2013-44144.3Cross-site scripting (XSS) vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to inject CVE-2013-44154.3Multiple cross-site scripting (XSS) vulnerabilities in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allow remote attackers to inject ar CVE-2013-44165.2The Ocaml xenstored implementation (oxenstored) in Xen 4.1.x, 4.2.x, and 4.3.x allows local guest domains to cause a denial of service (doma CVE-2013-44196.8The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ow CVE-2013-44205.8Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allo CVE-2013-44215.0The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory c CVE-2013-44226.8SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attacker CVE-2013-44235.5CloudForms stores user passwords in recoverable format CVE-2013-44244.3Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to i CVE-2013-44251.9The DICOM listener in OsiriX before 5.8 and before 2.5-MD, when starting up, encrypts the TLS private key file using "SuperSecretPassword" a CVE-2013-44263.6pyxtrlock before 0.1 uses an incorrect variable name, which allows physically proximate attackers to bypass the lock screen via multiple fai