{"id":"CVE-2013-0288","aliases":["DEBIAN-CVE-2013-0288","DSA-2628-1","EUVD-2013-0309","GHSA-rw67-8982-w823","RHSA-2013:0590","UBUNTU-CVE-2013-0288"],"status":"published","title":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a...","description":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03582,"percentile":0.8948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2013-02-18T00:00:00Z","modified":"2026-09-01T20:02:28Z","fixes":[{"ecosystem":"Debian:12","package":"nss-pam-ldapd","fixed_in":["0.8.10-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nss-pam-ldapd","fixed_in":["0.8.10-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nss-pam-ldapd","fixed_in":["0.8.10-3"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"nss-pam-ldapd","fixed_in":["0.7.15+squeeze3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-pam-ldapd","fixed_in":["0:0.7.5-18.1.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-pam-ldapd-debuginfo","fixed_in":["0:0.7.5-18.1.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-pam-ldapd","fixed_in":["0:0.7.5-18.1.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-pam-ldapd-debuginfo","fixed_in":["0:0.7.5-18.1.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-pam-ldapd","fixed_in":["0:0.7.5-18.1.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-pam-ldapd-debuginfo","fixed_in":["0:0.7.5-18.1.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-pam-ldapd","fixed_in":["0:0.7.5-18.1.el6_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-pam-ldapd-debuginfo","fixed_in":["0:0.7.5-18.1.el6_4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nss-pam-ldapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.10-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nss-pam-ldapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.10-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nss-pam-ldapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.10-3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"nss-pam-ldapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.15+squeeze3"}]}],"versions":["0.7.13","0.7.14","0.7.15","0.7.15+squeeze1","0.7.15+squeeze2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-pam-ldapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-18.1.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"nss-pam-ldapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-18.1.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-pam-ldapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-18.1.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"nss-pam-ldapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-18.1.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-pam-ldapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-18.1.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"nss-pam-ldapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-18.1.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-pam-ldapd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-18.1.el6_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"nss-pam-ldapd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.5-18.1.el6_4"}]}]}],"products":[{"vendor":"arthurdejong","product":"nss-pam-ldapd"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0590.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/58007","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690319","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.debian.org/security/2012/dsa-2628","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=7867b93f9a7c76b96f1571cddc1de0811134bb81","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/02/18/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-February/099438.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/52212","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=f266f05f20afe73e89c3946a7bd60bd7c5948e1b","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/52242","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=abf03bc54032beeff95b1b8634cc005137e11f32","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:106","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://lists.arthurdejong.org/nss-pam-ldapd-announce/2013/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/82175","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00087.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-03/msg00091.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0288","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0590","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=909119","tags":["report"]},{"url":"https://github.com/advisories/GHSA-rw67-8982-w823"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0288","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0590.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0288","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2013-0288","tags":["report"]},{"url":"http://arthurdejong.org/nss-pam-ldapd/CVE-2013-0288","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-0288","description":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.","status":"published","published":"2013-03-04T21:00:00Z","modified":"2024-08-06T14:18:09.878Z","updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2013-0309","description":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.","status":"published","published":"2013-03-04T21:00:00Z","modified":"2024-08-06T14:18:09Z","updated_at":"2026-11-03T01:56:45.704567Z"}],"ghsa":[{"id":"GHSA-rw67-8982-w823","title":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a...","description":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.","status":"published","published":"2022-05-05T02:48:43Z","modified":"2023-02-10T05:06:04Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:54:00.716708Z"}],"nvd":[{"id":"CVE-2013-0288","description":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.","status":"published","published":"2013-03-05T21:38:55.68Z","modified":"2026-06-16T23:49:07.717Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:24.091325Z"}],"osv":[{"id":"CVE-2013-0288","description":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.","status":"published","published":"2013-03-05T21:38:55Z","modified":"2026-04-10T03:42:38.22353Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0288","description":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.","status":"published","published":"2013-03-05T21:38:55.68Z","modified":"2026-09-01T20:02:28.896876878Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DSA-2628-1","title":"nss-pam-ldapd - buffer overflow","status":"published","published":"2013-02-18T00:00:00Z","modified":"2026-03-09T01:21:30.641023Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"RHSA-2013:0590","title":"Red Hat Security Advisory: nss-pam-ldapd security update","status":"published","published":"2024-09-15T20:39:00Z","modified":"2026-06-26T10:21:12Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"UBUNTU-CVE-2013-0288","description":"nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.","status":"withdrawn","published":"2013-03-05T21:38:00Z","modified":"2025-07-16T08:10:40.207437Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}