CVE-2013-4132 — NULL Pointer Dereference in Kde-workspace

CWE-310CWE-476 — NULL Pointer Dereference5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
0.8%
top 25.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
KDE Kde-workspaceKDE SCOpensuse
Timeline
PublishedSep 16
Latest updateMay 14

Description

KDE-Workspace 4.10.5 and earlier does not properly handle the return value of the glibc 2.17 crypt and pw_encrypt functions, which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via (1) an invalid salt or a (2) DES or (3) MD5 encrypted password, when FIPS-140 is enable, to KDM or an (4) invalid password to KCheckPass.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶NVDkde/kde-workspace4.10.5
▶NVDkde/kde_sc4.10.5

🔴Vulnerability Details

2
GHSA
GHSA-4vrh-wr8w-rqg2: KDE-Workspace 4↗2022-05-14
▶
CVEList
CVE-2013-4132: KDE-Workspace 4↗2013-09-16
▶

📋Vendor Advisories

1
Red Hat
kde-workspace: NULL pointer dereference in KDM and KCheckPass when glibc 2.17 or FIPS-140 enabled system used↗2013-06-29
▶

💬Community

1
Bugzilla
CVE-2013-4132 kde-workspace: NULL pointer dereference in KDM and KCheckPass when glibc 2.17 or FIPS-140 enabled system used↗2013-07-17
▶
CVE-2013-4132 — NULL Pointer Dereference | cvebase