CVE-2013-4560
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial...
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
Exploit likelihood
What each source reports
NVD Score used
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
- Record
CVE-2013-4560- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
- Record
CVE-2013-4560- Updated
- 2026-11-02
EUVDEUVD-2013-4419 No score
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
- Record
EUVD-2013-4419- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9r9f-9w9v-wrvp No score
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial...
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
- Record
GHSA-9r9f-9w9v-wrvp- Weakness
- CWE-416
- Updated
- 2026-11-02
OSV No score
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
- Record
CVE-2013-4560- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4560 No score
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
- Record
DEBIAN-CVE-2013-4560- Updated
- 2026-11-02
OSVMGASA-2013-0334 No score
Updated lighttpd packages fix multiple security vulnerbilities
Updated lighttpd packages fix security vulnerabilities:
lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network (CVE-2013-4508).
In lighttpd before 1.4.34, if setuid() fails for any reason, for instance if an environment limits the number of processes a user can have and the target uid already is at the limit, lighttpd will run as root. A user who can run CGI scripts could clone() often; in this case a lighttpd restart would end up with lighttpd running as root, and the CGI scripts would run as root too (CVE-2013-4559).
In lighttpd before 1.4.34, if "fam" is enabled and there are directories reachable from configured doc roots and aliases on which FAMMonitorDirectory fails, a remote client could trigger a DoS (CVE-2013-4560).
- Record
MGASA-2013-0334- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10402-1 No score
lighttpd-1.4.37-1.6 on GA media
These are all security issues fixed in the lighttpd-1.4.37-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10402-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4560 No score
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.
- Record
UBUNTU-CVE-2013-4560- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lighttpdDebian:12 |
before 1.4.33-1+nmu1 | 1.4.33-1+nmu1 |
lighttpdDebian:13 |
before 1.4.33-1+nmu1 | 1.4.33-1+nmu1 |
lighttpdDebian:14 |
before 1.4.33-1+nmu1 | 1.4.33-1+nmu1 |
lighttpdDebian:6.0 From an advisory covering 3 CVEs |
before 1.4.28-2+squeeze1.4, plus listed versions 1.4.28-21.4.28-2+squeeze11.4.28-2+squeeze1.11.4.28-2+squeeze1.21.4.28-2+squeeze1.3 |
1.4.28-2+squeeze1.4 |
lighttpdDebian:7 From an advisory covering 3 CVEs |
before 1.4.31-4+deb7u1, plus listed versions 1.4.31-4 |
1.4.31-4+deb7u1 |
lighttpdMageia:2 From an advisory covering 3 CVEs |
before 1.4.30-5.3.mga2 | 1.4.30-5.3.mga2 |
lighttpdMageia:3 From an advisory covering 3 CVEs |
before 1.4.32-3.6.mga3 | 1.4.32-3.6.mga3 |
lighttpdopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 1.4.37-1.6 | 1.4.37-1.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4560 is a medium vulnerability (CVSS 5.0) in Lighttpd, published November 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.42%, the 92nd percentile. Fixed in lighttpd 1.4.33-1+nmu1.
References
secunia.com/advisories/55682
marc.info?l=bugtraq&m=141576815022399&w=2
download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt
lists.opensuse.org/opensuse-updates/2014-01/msg00049.html
debian.org/security/2013/dsa-2795
openwall.com/lists/oss-security/2013/11/12/4
Show 18 moreShow less
jvn.jp/en/jp/JVN37417423/index.html
nvd.nist.gov/vuln/detail/CVE-2013-4560
github.com/advisories/GHSA-9r9f-9w9v-wrvp
security-tracker.debian.org/tracker/CVE-2013-4560
advisories.mageia.org/MGASA-2013-0334.html
bugs.mageia.org/show_bug.cgi?id=11662
ubuntu.com/security/CVE-2013-4560
cve.org/CVERecord?id=CVE-2013-4560
suse.com/security/cve/CVE-2010-0295