CVE-2013-2142
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local...
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
Exploit likelihood
What each source reports
NVD Score used
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
- Record
CVE-2013-2142- CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
- Record
CVE-2013-2142- Updated
- 2026-11-02
EUVDEUVD-2013-2107 No score
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
- Record
EUVD-2013-2107- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7wj3-4crv-vhfj No score
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local...
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
- Record
GHSA-7wj3-4crv-vhfj- Weakness
- CWE-59
- Updated
- 2026-11-02
OSV No score
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
- Record
CVE-2013-2142- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2142 No score
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
- Record
DEBIAN-CVE-2013-2142- Updated
- 2026-11-02
OSVMGASA-2013-0251 No score
Updated libimobiledevice packages fix CVE-2013-2142
Updated libimobiledevice packages fix security vulnerability:
Paul Collins discovered that libimobiledevice incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files and access device keys. In the default Ubuntu installation, this issue should be mitigated by the Yama link restrictions (CVE-2013-2142).
- Record
MGASA-2013-0251- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10459-1 No score
imobiledevice-tools-1.2.0-3.4 on GA media
These are all security issues fixed in the imobiledevice-tools-1.2.0-3.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10459-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libimobiledeviceDebian:12 |
before 1.1.5-0.1 | 1.1.5-0.1 |
libimobiledeviceDebian:13 |
before 1.1.5-0.1 | 1.1.5-0.1 |
libimobiledeviceDebian:14 |
before 1.1.5-0.1 | 1.1.5-0.1 |
libimobiledeviceMageia:3 |
before 1.1.4-4.1.mga3 | 1.1.4-4.1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2142 is a low vulnerability (CVSS 3.3) in Libimobiledevice, published August 17, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in libimobiledevice 1.1.5-0.1.
References
openwall.com/lists/oss-security/2013/06/04/11
bugs.launchpad.net/ubuntu/%2Bsource/libimobiledevice/%2Bbug/1164263
libiphone.lighthouseapp.com/projects/27916-libiphone/tickets/331-insecure-tmp-directory-use
ubuntu.com/usn/USN-1927-1
nvd.nist.gov/vuln/detail/CVE-2013-2142
github.com/advisories/GHSA-7wj3-4crv-vhfj