CVE-2013-4362
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via...
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
Exploit likelihood
What each source reports
NVD Score used
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
- Record
CVE-2013-4362- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
- Record
CVE-2013-4362- Updated
- 2026-11-02
EUVDEUVD-2013-4246 No score
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
- Record
EUVD-2013-4246- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-647p-v28r-5qg4 No score
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via...
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
- Record
GHSA-647p-v28r-5qg4- Updated
- 2026-11-02
OSV No score
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
- Record
CVE-2013-4362- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4362 No score
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
- Record
DEBIAN-CVE-2013-4362- Updated
- 2026-11-02
OSVMGASA-2013-0304 No score
Updated davfs2 packages fix CVE-2013-4362
Updated davfs2 package fixes security vulnerability:
Davfs2, a filesystem client for WebDAV, calls the function system() insecurely while is setuid root. This might allow a privilege escalation. (CVE-2013-4362)
- Record
MGASA-2013-0304- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4362 No score
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.
- Record
UBUNTU-CVE-2013-4362- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
davfs2Debian:12 |
before 1.4.7-3 | 1.4.7-3 |
davfs2Debian:13 |
before 1.4.7-3 | 1.4.7-3 |
davfs2Debian:14 |
before 1.4.7-3 | 1.4.7-3 |
davfs2Debian:6.0 |
before 1.4.6-1.1+squeeze1, plus listed versions 1.4.6-11.4.6-1.1 |
1.4.6-1.1+squeeze1 |
davfs2Debian:7 |
before 1.4.6-1.1+deb7u1, plus listed versions 1.4.6-1.1 |
1.4.6-1.1+deb7u1 |
davfs2Mageia:2 |
before 1.4.6-1.1.mga2 | 1.4.6-1.1.mga2 |
davfs2Mageia:3 |
before 1.4.7-3.1.mga3 | 1.4.7-3.1.mga3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | davfs2 1.4.6/1.4.7 - Local Privilege Escalation | 2013-10-08 |
| PoC in GitHub | notclement/Automatic-davfs2-1.4.6-1.4.7-Local-Privilege-Escalation | 2020-09-10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4362 is a high vulnerability (CVSS 7.2) in Werner Baumann Davfs2, published September 26, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.17%, the 67th percentile. Fixed in davfs2 1.4.7-3.
References
debian.org/security/2013/dsa-2765
osvdb.org/97417
security.gentoo.org/glsa/201612-02
seclists.org/oss-sec/2013/q3/627
savannah.nongnu.org/bugs?40034
Show 8 moreShow less
securityfocus.com/bid/62445
nvd.nist.gov/vuln/detail/CVE-2013-4362
github.com/advisories/GHSA-647p-v28r-5qg4
security-tracker.debian.org/tracker/CVE-2013-4362
advisories.mageia.org/MGASA-2013-0304.html
bugs.mageia.org/show_bug.cgi?id=11300
ubuntu.com/security/CVE-2013-4362
cve.org/CVERecord?id=CVE-2013-4362