CVE-2013-4560

Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial...

5.0 MediumFix available

CVE-2013-4560 is a medium vulnerability (CVSS 5.0) in Lighttpd, published November 13, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.42%, the 92nd percentile. Fixed in lighttpd 1.4.33-1+nmu1.

What does this mean?

Severity: 5.0 MediumCVSS 2.0, NVD
Exploit chance: 5.42%EPSS, 92nd percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.4.33-1+nmu1lighttpd +7 more

Description

Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.

Exploit likelihood

5.42%Up 4.1 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`lighttpd` Debian:12	before 1.4.33-1+nmu1	1.4.33-1+nmu1
`lighttpd` Debian:13	before 1.4.33-1+nmu1	1.4.33-1+nmu1
`lighttpd` Debian:14	before 1.4.33-1+nmu1	1.4.33-1+nmu1
`lighttpd` Debian:6.0 From an advisory covering 3 CVEs	before 1.4.28-2+squeeze1.4, plus listed versions 1.4.28-21.4.28-2+squeeze11.4.28-2+squeeze1.11.4.28-2+squeeze1.21.4.28-2+squeeze1.3	1.4.28-2+squeeze1.4
`lighttpd` Debian:7 From an advisory covering 3 CVEs	before 1.4.31-4+deb7u1, plus listed versions 1.4.31-4	1.4.31-4+deb7u1
`lighttpd` Mageia:2 From an advisory covering 3 CVEs	before 1.4.30-5.3.mga2	1.4.30-5.3.mga2
`lighttpd` Mageia:3 From an advisory covering 3 CVEs	before 1.4.32-3.6.mga3	1.4.32-3.6.mga3
`lighttpd` openSUSE:Tumbleweed From an advisory covering 8 CVEs	before 1.4.37-1.6	1.4.37-1.6

What each source reports

NVD Score used5.0

Record: CVE-2013-4560
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-416
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2013-4560
Updated: 2026-11-02

EUVDEUVD-2013-4419No score

Record: EUVD-2013-4419
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9r9f-9w9v-wrvpNo score

Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial...

Record: GHSA-9r9f-9w9v-wrvp
Weakness: CWE-416
Updated: 2026-11-02

OSVNo score

Record: CVE-2013-4560
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-4560No score

Record: DEBIAN-CVE-2013-4560
Updated: 2026-11-02

OSVMGASA-2013-0334No score

Updated lighttpd packages fix multiple security vulnerbilities

Updated lighttpd packages fix security vulnerabilities:

lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network (CVE-2013-4508).

In lighttpd before 1.4.34, if setuid() fails for any reason, for instance if an environment limits the number of processes a user can have and the target uid already is at the limit, lighttpd will run as root. A user who can run CGI scripts could clone() often; in this case a lighttpd restart would end up with lighttpd running as root, and the CGI scripts would run as root too (CVE-2013-4559).

In lighttpd before 1.4.34, if "fam" is enabled and there are directories reachable from configured doc roots and aliases on which FAMMonitorDirectory fails, a remote client could trigger a DoS (CVE-2013-4560).

Record: MGASA-2013-0334
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10402-1No score

lighttpd-1.4.37-1.6 on GA media

These are all security issues fixed in the lighttpd-1.4.37-1.6 package on the GA media of openSUSE Tumbleweed.