CVE-2013-2220
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for...
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
- Record
CVE-2013-2220- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
- Record
CVE-2013-2220- Updated
- 2026-11-02
EUVDEUVD-2013-2173 No score
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
- Record
EUVD-2013-2173- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4x5w-qg6w-8rqm No score
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for...
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
- Record
GHSA-4x5w-qg6w-8rqm- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
- Record
CVE-2013-2220- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2220 No score
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
- Record
DEBIAN-CVE-2013-2220- Updated
- 2026-11-02
OSVMGASA-2013-0206 No score
Updated php-radius packages fix CVE-2013-2220
Updated php-radius package fixes security vulnerability:
Fix a security issue in radius_get_vendor_attr() by enforcing checks of the VSA length field against the buffer size (CVE-2013-2220).
- Record
MGASA-2013-0206- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-2220 No score
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.
- Record
UBUNTU-CVE-2013-2220- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
php-radiusDebian:11 |
before 1.2.5-2.4 | 1.2.5-2.4 |
php-radiusDebian:6.0 |
before 1.2.5-2+squeeze1, plus listed versions 1.2.5-2 |
1.2.5-2+squeeze1 |
php-radiusDebian:7 |
before 1.2.5-2.3+deb7u1, plus listed versions 1.2.5-2.3 |
1.2.5-2.3+deb7u1 |
php-radiusMageia:2 |
before 1.2.7-1.mga2 | 1.2.7-1.mga2 |
php-radiusMageia:3 |
before 1.2.7-1.mga3 | 1.2.7-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2220 is a high vulnerability (CVSS 7.5) in Radius Extension Project Radius, published July 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.68%, the 89th percentile. Fixed in php-radius 1.2.5-2.4.
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=714362
github.com/LawnGnome/php-radius/commit/13c149b051f82b709e8d7cc32111e84b49d57234
debian.org/security/2013/dsa-2726
pecl.php.net/package/radius/1.2.7
nvd.nist.gov/vuln/detail/CVE-2013-2220
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2013-2220
advisories.mageia.org/MGASA-2013-0206.html
mandriva.com/en/support/security/advisories/advisory/MDVSA-2013:192
bugs.mageia.org/show_bug.cgi?id=10642
ubuntu.com/security/CVE-2013-2220
openwall.com/lists/oss-security/2013/06/28/2
cve.org/CVERecord?id=CVE-2013-2220