7.5

CVE-2013-4365: apache mod_fcgid Out-of-bounds Write

CVSS: 7.5v2.0HighModified
AliasesMGASA-2013-0313DEBIAN-CVE-2013-4365DSA-2778-1
Published 17-10-2013Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2013-4365 is a high (CVSS 7.5) Out-of-bounds Write vulnerability in apache mod_fcgid. EPSS estimates a 13.60% chance of exploitation in the next 30 days, higher than 96.4% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v2.0 (NVD)
EPSS score
13.60%
0%100%
Medium · +0.35 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2024:10564-1

Timeline

  1. 17-10-2013
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

13.60%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

+0.35 pp

From 13.25% on 18-09-2026

18-09-202618-10-2026
EPSS score
13.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • libapache2-mod-fcgid< 1:2.3.9-1 | < 1:2.3.6-1+squeeze2 | < 1:2.3.6-1.2+deb7u1
  • debian_linuxEOL6.0 | 7.0
Mageia2 products
  • apache-mod_fcgid< 2.3.6-2.2.mga2
  • apache-mod_fcgid< 2.3.9-1.mga3
Suse2 products
Apache1 product
Opensuse1 product

5 vendors · 8 products

References

12 links
Show all 12 references