CVE-2013-5144

LowCVSS 3.3/10Last modified Jun 16, 2026

Description

Passcode Lock in Apple iOS before 7.0.3 on iPhone devices allows physically proximate attackers to bypass an intended passcode requirement, and dial arbitrary telephone numbers, by tapping the emergency-call button during a certain notification and camera-pane state to trigger a NULL pointer dereference.

Metrics

CVSS 2.0 3.3/10AV:L/AC:M/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published: Oct 24, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-51456.3kextd in Kext Management in Apple iOS before 7 does not properly verify authorization for IPC messages, which allows local users to (1) load CVE-2013-51473.7Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attackers to bypass an intend CVE-2013-51487.2Apple Keynote before 6.0 does not properly handle the interaction between Keynote presentation mode and the Screen Lock implementation, whic CVE-2013-51494.3The Push Notifications subsystem in Apple iOS before 7 provides the push-notification token to an app without user approval, which allows at CVE-2013-51501.9The history-clearing feature in Safari in Apple iOS before 7 does not clear the back/forward history of an open tab, which allows physically CVE-2013-51514.3Mobile Safari in Apple iOS before 7 does not prevent HTML interpretation of a document served with a text/plain content type, which allows r CVE-2013-51524.3Mobile Safari in Apple iOS before 7 allows remote attackers to spoof the URL bar via a crafted web site.CVE-2013-51532.1Springboard in Apple iOS before 7 does not properly manage the lock state in Lost Mode, which allows physically proximate attackers to read CVE-2013-51544.3The Sandbox subsystem in Apple iOS before 7 determines the sandboxing requirement for a #! application on the basis of the script interprete CVE-2013-51557.1The Sandbox subsystem in Apple iOS before 7 allows attackers to cause a denial of service (infinite loop) via an application that writes cra CVE-2013-51564.3The Telephony subsystem in Apple iOS before 7 does not require API conformity for access to telephony-daemon interfaces, which allows attack CVE-2013-51575.0The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers