CVE-2013-4391 — Integer Overflow or Wraparound in Project Systemd

CWE-190 — Integer Overflow or WraparoundCWE-122 — Heap-based Buffer Overflow7 documents7 sources
Severity
7.5HIGHNVD
EPSS
3.7%
top 12.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Systemd Project SystemdDebian Linux
Timeline
PublishedOct 28
Latest updateMay 13

Description

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large journal data field, which triggers a heap-based buffer overflow.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶Debiansystemd_project/systemd< 204-5+3

Also affects: Debian Linux 7.0

Patches

Patch: bugs.debian.org ↗Patch: cgit.freedesktop.org ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-5jjc-6f35-8hmp: Integer overflow in the valid_user_field function in journal/journald-native↗2022-05-13
▶
OSV
CVE-2013-4391: Integer overflow in the valid_user_field function in journal/journald-native↗2013-10-28
▶
CVEList
CVE-2013-4391: Integer overflow in the valid_user_field function in journal/journald-native↗2013-10-28
▶

📋Vendor Advisories

2
Red Hat
systemd: Integer overflow, leading to heap-based buffer overflow by processing native messages↗2013-09-23
▶
Debian
CVE-2013-4391: systemd - Integer overflow in the valid_user_field function in journal/journald-native.c i...↗2013
▶

💬Community

1
Bugzilla
CVE-2013-4391 systemd: Integer overflow, leading to heap-based buffer overflow by processing native messages↗2012-09-20
▶
CVE-2013-4391 — Integer Overflow or Wraparound | cvebase