CVE-2013-6402
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to...
CVE-2013-6402 is a low vulnerability (CVSS 2.1) in Hp Linux Imaging And Printing Project, published December 28, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in hplip 3.13.11-2.1.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.49%EPSS, 42nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.13.11-2.1hplip +5 more
Description
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hplipDebian:12 | before 3.13.11-2.1 | 3.13.11-2.1 |
hplipDebian:13 | before 3.13.11-2.1 | 3.13.11-2.1 |
hplipDebian:6.0 From an advisory covering 4 CVEs | before 3.10.6-2+squeeze2, plus listed versions 3.10.6-23.10.6-2+squeeze1 | 3.10.6-2+squeeze2 |
hplipDebian:7 From an advisory covering 4 CVEs | before 3.12.6-3.1+deb7u1, plus listed versions 3.12.6-3.1 | 3.12.6-3.1+deb7u1 |
hplipMageia:3 From an advisory covering 2 CVEs | before 3.12.9-6.3.mga3 | 3.12.9-6.3.mga3 |
hplipopenSUSE:Tumbleweed From an advisory covering 8 CVEs | before 3.16.10-1.1 | 3.16.10-1.1 |
What each source reports
NVD Score used
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
- Record
CVE-2013-6402- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE ListNo score
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
- Record
CVE-2013-6402- Updated
- 2026-11-02
EUVDEUVD-2013-6223No score
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
- Record
EUVD-2013-6223- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6q8g-8jp7-r627No score
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to...
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
- Record
GHSA-6q8g-8jp7-r627- Weakness
- CWE-59
- Updated
- 2026-11-02
OSVNo score
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
- Record
CVE-2013-6402- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6402No score
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.
- Record
DEBIAN-CVE-2013-6402- Updated
- 2026-11-02
OSVMGASA-2014-0033No score
Updated hplip package fixes security vulnerabilities
It was discovered that the HPLIP Polkit daemon incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files. (CVE-2013-6402)
It was discovered that HPLIP contained an upgrade tool that would download code in an unsafe fashion. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to execute arbitrary code. (CVE-2013-6427)
Additionnally, this update should fix issues regarding wireless connection to printer hplip after 3.12.9 and prior to version 3.12.11 had issues with setting up wireless connection to printers due to internal code changes which had not been applied consistently.
- Record
MGASA-2014-0033- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10083-1No score
hplip-3.16.10-1.1 on GA media
These are all security issues fixed in the hplip-3.16.10-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10083-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
ubuntu.com/usn/USN-2085-1
bugzilla.novell.com/show_bug.cgi?id=852368
security-tracker.debian.org/tracker/CVE-2013-6402
lists.opensuse.org/opensuse-updates/2014-01/msg00087.html
bugs.debian.org/cgi-bin/bugreport.cgi?bug=725876
debian.org/security/2013/dsa-2829
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-6402
github.com/advisories/GHSA-6q8g-8jp7-r627
advisories.mageia.org/MGASA-2014-0033.html
bugs.mageia.org/show_bug.cgi?id=11809
bugs.launchpad.net/hplip/+bug/1048754
suse.com/security/cve/CVE-2004-0801