CVE

Id
64506  
CVE No.
CVE-2013-4559  
Status
Candidate  
Description
lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.  
Phase
Assigned (20130612)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
635818 64506 CVE-2013-4559 MLIST:[oss-security] 20131112 Re: CVE Request: lighttpd multiple issues (setuid/... unchecked return value, FAM: read after free)  View
635819 64506 CVE-2013-4559 URL:http://www.openwall.com/lists/oss-security/2013/11/12/4  View
635820 64506 CVE-2013-4559 CONFIRM:http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt  View
635821 64506 CVE-2013-4559 DEBIAN:DSA-2795  View
635822 64506 CVE-2013-4559 URL:https://www.debian.org/security/2013/dsa-2795  View
635823 64506 CVE-2013-4559 HP:HPSBGN03191  View
635824 64506 CVE-2013-4559 URL:http://marc.info/?l=bugtraq&m=141576815022399&w=2  View
635825 64506 CVE-2013-4559 SUSE:openSUSE-SU-2014:0072  View
635826 64506 CVE-2013-4559 URL:http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html  View
635827 64506 CVE-2013-4559 SECUNIA:55682  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
24211 JVNDB-2013-005786 Libreswan におけるサービス運用妨害 (DoS) の脆弱性 Libreswan には、サービス運用妨害 (クラッシュ) 状態にされる脆弱性が存在します。 CVE-2013-4564 64506 5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005786.html  View