CVE-2013-4365

Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the...

7.5 HighFix available

CVE-2013-4365 is a high vulnerability (CVSS 7.5) in Apache Mod Fcgid, published October 12, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.6%, the 96th percentile. Fixed in libapache2-mod-fcgid 1:2.3.9-1.

Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.

Exploit likelihood

13.6%Up 10.2 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2013-4365
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-4365
Updated: 2026-11-02

EUVDEUVD-2013-4248 No score

Record: EUVD-2013-4248
Updated: 2026-11-03

GitHub AdvisoriesGHSA-pvf8-q83q-x8pr No score

Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the...

Record: GHSA-pvf8-q83q-x8pr
Weakness: CWE-787
Updated: 2026-11-02

OSVBELL-CVE-2013-4365 7.5

CVE-2013-4365 does not affect BellSoft software

Record: BELL-CVE-2013-4365
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

OSV No score

Record: CVE-2013-4365
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-4365 No score

Record: DEBIAN-CVE-2013-4365
Updated: 2026-11-02

OSVMGASA-2013-0313 No score

Updated apache-mod_fcgid packages fix CVE-2013-4365

Updated apache-mod_fcgid package fixes security vulnerability:

Apache mod_fcgid before version 2.3.9 fails to perform adequate boundary checks on user-supplied input. This may allow a remote attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code (CVE-2013-4365).

Record: MGASA-2013-0313
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10564-1 No score

apache2-mod_fcgid-2.3.9-7.3 on GA media

These are all security issues fixed in the apache2-mod_fcgid-2.3.9-7.3 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10564-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libapache2-mod-fcgid` Debian:12	before 1:2.3.9-1	1:2.3.9-1
`libapache2-mod-fcgid` Debian:13	before 1:2.3.9-1	1:2.3.9-1
`libapache2-mod-fcgid` Debian:14	before 1:2.3.9-1	1:2.3.9-1
`libapache2-mod-fcgid` Debian:6.0	before 1:2.3.6-1+squeeze2, plus listed versions 1:2.3.6-11:2.3.6-1+squeeze1	1:2.3.6-1+squeeze2
`libapache2-mod-fcgid` Debian:7	before 1:2.3.6-1.2+deb7u1, plus listed versions 1:2.3.6-1.2	1:2.3.6-1.2+deb7u1
`apache-mod_fcgid` Mageia:2	before 2.3.6-2.2.mga2	2.3.6-2.2.mga2
`apache-mod_fcgid` Mageia:3	before 2.3.9-1.mga3	2.3.9-1.mga3
`apache2-mod_fcgid` openSUSE:Tumbleweed	before 2.3.9-7.3	2.3.9-7.3

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 13 moreShow less