CVE-2013-7283

CriticalCVSS 9.3/10Last modified Jun 17, 2026

Description

Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecified impact and attack vectors, involving the /var/tmp/libreswan-nss-pwd temporary file.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/56276Vendor Advisory
http://www.osvdb.org/101575
https://github.com/libreswan/libreswan/commit/ef2d756e73a188401c36133c2e2f7ce4f3c6ae55Exploit, Patch
https://lists.libreswan.org/pipermail/swan-announce/2013/000007.htmlVendor Advisory
http://secunia.com/advisories/56276Vendor Advisory
http://www.osvdb.org/101575
https://github.com/libreswan/libreswan/commit/ef2d756e73a188401c36133c2e2f7ce4f3c6ae55Exploit, Patch
https://lists.libreswan.org/pipermail/swan-announce/2013/000007.htmlVendor Advisory

Timeline

Published: Jan 9, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-72846.8The PlRPC module, possibly 0.2020 and earlier, for Perl uses the Storable module, which allows remote attackers to execute arbitrary code vi CVE-2013-72859.8Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run CVE-2013-72867.5MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm CVE-2013-72879.8MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme.CVE-2013-72884.3Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6 CVE-2013-72894.3Multiple cross-site scripting (XSS) vulnerabilities in register.php in Andy's PHP Knowledgebase (Aphpkb) before 0.95.8 allow remote attacker CVE-2013-72901.8The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attacke CVE-2013-72911.8memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that trigg CVE-2013-72923.5VASCO IDENTIKEY Authentication Server (IAS) 3.4.x allows remote authenticated users to bypass Active Directory (AD) authentication by enteri CVE-2013-72935.0The ASUS WL-330NUL router has a configuration process that relies on accessing the 192.168.1.1 IP address, but the documentation advises use CVE-2013-72945.0The ikev2parent_inI1outR1 function in pluto/ikev2_parent.c in libreswan before 3.7 allows remote attackers to cause a denial of service (res CVE-2013-72954.0Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platf