Vulnerability Name:

CVE-2013-4788 (CCN-85800)

Assigned:2013-07-16
Published:2013-07-16
Updated:2017-07-01
Summary:The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.
Additional information that was taken into consideration while scoring:

https://bugzilla.redhat.com/show_bug.cgi?id=985625
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:5.1 Medium (CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
4.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2013-4788

Source: MISC
Type: Exploit, Patch
http://hmarco.org/bugs/CVE-2013-4788.html

Source: FULLDISC
Type: UNKNOWN
20150907 Glibc Pointer guarding weakness

Source: CCN
Type: EGLIBC Web Site
EGLIBC: EGLIBC

Source: CCN
Type: GNU Web site
glibc

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2013:283

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2013:284

Source: MLIST
Type: Exploit, Patch
[oss-security] 20130716 Re: CVE-2013-4788 - Eglibc PTR MANGLE bug

Source: BID
Type: UNKNOWN
61183

Source: CCN
Type: BID-61183
glibc and eglibc CVE-2013-4788 Buffer Overflow Vulnerability

Source: CCN
Type: Red Hat Bugzilla Bug 985625
CVE-2013-4788 glibc: PTR_MANGLE does not initialize to a random value for the pointer guard when compiling static executables

Source: XF
Type: UNKNOWN
eglibc-cve20134788-bo(85800)

Source: CCN
Type: Packet Storm Security [7-16-2013]
Eglibc PTR MANGLE Bug

Source: GENTOO
Type: UNKNOWN
GLSA-201503-04

Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [09-30-2013]

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2013-4788

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnu:glibc:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.1.6:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.1.9:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.4:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.10.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.11.3:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.12.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.12.2:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.13:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.14:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.14.1:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.15:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.16:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:*:*:*:*:*:*:*:* (Version <= 2.17)

    • Configuration 2:
  • cpe:/a:gnu:eglibc:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnu:glibc:2.7:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.5:*:*:*:*:*:*:*
  • OR cpe:/a:gnu:glibc:2.13:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20134788
    V
    		CVE-2013-4788
    2022-05-20
    oval:org.opensuse.security:def:33067
    P
    		Security update for libqt4 (Important)
    2021-12-22
    oval:org.opensuse.security:def:26182
    P
    		Security update for MozillaFirefox (Important)
    2021-12-12
    oval:org.opensuse.security:def:33060
    P
    		Security update for MozillaFirefox (Important)
    2021-12-12
    oval:org.opensuse.security:def:33056
    P
    		Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:33055
    P
    		Security update for clamav (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:26170
    P
    		Security update for postgresql12 (Important)
    2021-11-22
    oval:org.opensuse.security:def:26171
    P
    		Security update for postgresql10 (Important)
    2021-11-22
    oval:org.opensuse.security:def:26167
    P
    		Security update for php72 (Moderate)
    2021-11-19
    oval:org.opensuse.security:def:33735
    P
    		Security update for tomcat (Important)
    2021-11-03
    oval:org.opensuse.security:def:32212
    P
    		Security update for binutils (Moderate)
    2021-11-02
    oval:org.opensuse.security:def:31688
    P
    		Security update for python-urllib3 (Moderate)
    2021-09-29
    oval:org.opensuse.security:def:34529
    P
    		Security update for file (Important)
    2021-09-02
    oval:org.opensuse.security:def:29400
    P
    		Security update for systemd (Important)
    2021-07-21
    oval:org.opensuse.security:def:33678
    P
    		Security update for ovmf (Important)
    2021-06-24
    oval:org.opensuse.security:def:36414
    P
    		glibc-html-2.11.3-17.84.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42543
    P
    		glibc-2.11.3-17.84.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36136
    P
    		glibc-2.11.3-17.84.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:31614
    P
    		Security update for java-1_7_0-openjdk (Moderate)
    2021-04-29
    oval:org.opensuse.security:def:26039
    P
    		Security update for libnettle (Important)
    2021-04-28
    oval:org.opensuse.security:def:33891
    P
    		Security update for xorg-x11-server (Important)
    2021-04-13
    oval:org.opensuse.security:def:26027
    P
    		Security update for glibc (Important)
    2021-04-13
    oval:org.opensuse.security:def:31603
    P
    		Security update for fwupdate (Important)
    2021-04-08
    oval:org.opensuse.security:def:33099
    P
    		Security update for python36 (Moderate)
    2021-03-19
    oval:org.opensuse.security:def:55869
    P
    		Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP2) (Important)
    2021-03-17
    oval:org.opensuse.security:def:32268
    P
    		Security update for openldap2 (Important)
    2021-03-03
    oval:org.opensuse.security:def:57145
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-02-10
    oval:org.opensuse.security:def:34569
    P
    		Security update for the Linux Kernel (Important)
    2021-02-09
    oval:org.opensuse.security:def:26111
    P
    		Security update for cups (Moderate)
    2021-02-02
    oval:org.opensuse.security:def:54746
    P
    		Security update for MozillaFirefox (Important)
    2021-01-29
    oval:org.opensuse.security:def:33784
    P
    		Security update for MozillaFirefox (Important)
    2021-01-12
    oval:org.opensuse.security:def:29485
    P
    		Security update for MozillaFirefox (Important)
    2021-01-12
    oval:org.opensuse.security:def:55191
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:55788
    P
    		Security update for cyrus-sasl (Important)
    2020-12-28
    oval:org.opensuse.security:def:25975
    P
    		Security update for openssl-1_0_0 (Important)
    2020-12-09
    oval:org.opensuse.security:def:25970
    P
    		Security update for gdm (Important)
    2020-12-03
    oval:org.opensuse.security:def:33376
    P
    		Security update for sap_suse_cluster_connector
    2020-12-01
    oval:org.opensuse.security:def:25686
    P
    		Security update for wicked (Important)
    2020-12-01
    oval:org.opensuse.security:def:26315
    P
    		Security update for MozillaThunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26461
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:25963
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:26540
    P
    		enscript on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26695
    P
    		fetchmail on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26246
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26596
    P
    		libpng12-0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26888
    P
    		emacs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27619
    P
    		Security update for glibc
    2020-12-01
    oval:org.opensuse.security:def:27118
    P
    		evince on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27449
    P
    		libgnutls-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27786
    P
    		Security update for lcms2
    2020-12-01
    oval:org.opensuse.security:def:28521
    P
    		Security update for openvpn-openssl1 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29046
    P
    		Security update for apache2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29343
    P
    		Security update for cobbler (Important)
    2020-12-01
    oval:org.opensuse.security:def:29692
    P
    		Security update for expat (Important)
    2020-12-01
    oval:org.opensuse.security:def:29842
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:54345
    P
    		pam on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55476
    P
    		Security update for gnome-settings-daemon (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32056
    P
    		Security update for kvm (Important)
    2020-12-01
    oval:org.opensuse.security:def:32356
    P
    		Security update for squid3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:33433
    P
    		Security update for Cyrus IMAPD
    2020-12-01
    oval:org.opensuse.security:def:25697
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26364
    P
    		Security update for irssi (Low)
    2020-12-01
    oval:org.opensuse.security:def:27099
    P
    		coreutils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25964
    P
    		Security update for libraw (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26248
    P
    		Security update for freerdp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26593
    P
    		libnetpbm10 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26739
    P
    		libapr1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26374
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:26747
    P
    		libgdiplus0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26902
    P
    		gd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27182
    P
    		libexif on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27533
    P
    		perl-DBD-Pg on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27825
    P
    		Security update for libxml2
    2020-12-01
    oval:org.opensuse.security:def:28556
    P
    		Security update for glibc
    2020-12-01
    oval:org.opensuse.security:def:29057
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:29741
    P
    		Security update for freetype2
    2020-12-01
    oval:org.opensuse.security:def:30480
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:54346
    P
    		pam-modules on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:54919
    P
    		libquicktime0 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55584
    P
    		Security update for gnutls (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31602
    P
    		Security update for tomcat6
    2020-12-01
    oval:org.opensuse.security:def:31820
    P
    		Security update for augeas (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32378
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33146
    P
    		libevent-1_4-2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33521
    P
    		Security update for strongswan
    2020-12-01
    oval:org.opensuse.security:def:33823
    P
    		Security update for glibc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25761
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26403
    P
    		Security update for ffmpeg (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27134
    P
    		glibc on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26305
    P
    		Security update for python-setuptools (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26642
    P
    		sysstat on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27377
    P
    		boost-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26455
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:26800
    P
    		pango on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26946
    P
    		libecpg6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27106
    P
    		davfs2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27310
    P
    		tomcat6 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27684
    P
    		Security update for xorg-x11-server
    2020-12-01
    oval:org.opensuse.security:def:27839
    P
    		Security update for mysql (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29126
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:29780
    P
    		Security update for gnutls (Important)
    2020-12-01
    oval:org.opensuse.security:def:30517
    P
    		Security update for glibc
    2020-12-01
    oval:org.opensuse.security:def:54368
    P
    		python-pywbem on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55025
    P
    		unixODBC on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55676
    P
    		Security update for postgresql93 (Important)
    2020-12-01
    oval:org.opensuse.security:def:31912
    P
    		Security update for gcc43 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32422
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33281
    P
    		vsftpd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33847
    P
    		Security update for okular
    2020-12-01
    oval:org.opensuse.security:def:25685
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25889
    P
    		Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:26262
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26417
    P
    		Security update for Mozilla Thunderbird (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26389
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:26681
    P
    		curl on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27412
    P
    		glibc-html on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26512
    P
    		Security update for pdns-recursor (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26849
    P
    		zoo on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27584
    P
    		xorg-x11-libXfixes-devel-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27107
    P
    		dbus-1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27392
    P
    		emacs-nox on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27737
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:27883
    P
    		Security update for rubygem-bundler
    2020-12-01
    oval:org.opensuse.security:def:29045
    P
    		Security update for adns (Important)
    2020-12-01
    oval:org.opensuse.security:def:29257
    P
    		Security update for tomcat6 (Important)
    2020-12-01
    oval:org.opensuse.security:def:29638
    P
    		Security update for coreutils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29798
    P
    		Security update for icu
    2020-12-01
    oval:org.opensuse.security:def:54508
    P
    		lcms on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:55750
    P
    		Security update for gpg2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57219
    P
    		Security update for glibc
    2020-12-01
    oval:org.opensuse.security:def:31969
    P
    		Security update for ipsec-tools (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32317
    P
    		Security update for rsync (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:26627
    P
    		SUSE-SU-2014:1122-1 -- Security update for glibc
    2014-11-10
    oval:org.mitre.oval:def:25129
    P
    		SUSE-SU-2013:1852-1 -- Security update for glibc
    2014-09-08
    oval:org.mitre.oval:def:25513
    P
    		SUSE-SU-2013:1854-1 -- Security update for glibc
    2014-09-08
    oval:com.ubuntu.precise:def:20134788000
    V
    		CVE-2013-4788 on Ubuntu 12.04 LTS (precise) - low.
    2013-10-04
    oval:com.ubuntu.trusty:def:20134788000
    V
    		CVE-2013-4788 on Ubuntu 14.04 LTS (trusty) - low.
    2013-10-04
    oval:org.opensuse.security:def:79853
    P
    		Security update for glibc
    2013-09-13
    BACK
    gnu glibc 2.0
    gnu glibc 2.0.1
    gnu glibc 2.0.2
    gnu glibc 2.0.3
    gnu glibc 2.0.4
    gnu glibc 2.0.5
    gnu glibc 2.0.6
    gnu glibc 2.1
    gnu glibc 2.1.1
    gnu glibc 2.1.1.6
    gnu glibc 2.1.2
    gnu glibc 2.1.3
    gnu glibc 2.1.9
    gnu glibc 2.4
    gnu glibc 2.10.1
    gnu glibc 2.11
    gnu glibc 2.11.1
    gnu glibc 2.11.2
    gnu glibc 2.11.3
    gnu glibc 2.12.1
    gnu glibc 2.12.2
    gnu glibc 2.13
    gnu glibc 2.14
    gnu glibc 2.14.1
    gnu glibc 2.15
    gnu glibc 2.16
    gnu glibc *
    gnu eglibc *
    gnu glibc 2.7
    gnu glibc 2.5
    gnu glibc 2.13