{"id":"CVE-2013-2131","aliases":["DEBIAN-CVE-2013-2131","EUVD-2013-2099","GHSA-fw9w-xf98-wvqv","SUSE-SU-2017:0103-1","UBUNTU-CVE-2013-2131","openSUSE-SU-2024:10163-1"],"status":"published","title":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows...","description":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.1059,"percentile":0.95817,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-134"],"published":"2015-01-04T21:00:00Z","modified":"2026-09-01T20:03:16Z","exploits":[{"source":"exploitdb","id":"EDB-38521","title":"Python RRDtool Module - Function Format String","type":"remote","platform":"multiple","date":"2013-05-18","verified":true,"url":"https://www.exploit-db.com/exploits/38521"}],"fixes":[{"ecosystem":"Debian:12","package":"rrdtool","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rrdtool","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rrdtool","fixed_in":["1.4.8-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"rrdtool","fixed_in":["1.4.7-20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"rrdtool","fixed_in":["1.4.7-20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"rrdtool","fixed_in":["1.4.7-20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"rrdtool","fixed_in":["1.4.7-20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"rrdtool","fixed_in":["1.4.7-20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"rrdtool","fixed_in":["1.4.7-20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"rrdtool","fixed_in":["1.4.7-20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"rrdtool","fixed_in":["1.4.7-20.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"rrdtool","fixed_in":["1.4.7-20.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"rrdtool","fixed_in":["1.7.0-1build1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"rrdtool","fixed_in":["1.7.2-3build1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rrdtool","fixed_in":["1.7.2-3ubuntu5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.8-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-20.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-20.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.7-2ubuntu2","1.4.7-2ubuntu3","1.4.7-2ubuntu4","1.4.7-2ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1build1"}]}],"versions":["1.6.0-1ubuntu2","1.7.0-0ubuntu4","1.7.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-3build1"}]}],"versions":["1.7.1-2","1.7.2-1ubuntu2","1.7.2-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rrdtool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-3ubuntu5"}]}],"versions":["1.7.2-3build6","1.7.2-3ubuntu1","1.7.2-3ubuntu2"]}],"products":[{"vendor":"rrdtool_project","product":"rrdtool"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/04/18/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=969296","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"https://github.com/oetiker/rrdtool-1.x/pull/397","tags":["x_refsource_MISC","x_transferred","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/19/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/oetiker/rrdtool-1.x/issues/396","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/05/31/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2131"},{"url":"https://github.com/advisories/GHSA-fw9w-xf98-wvqv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2131","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170103-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/828003","tags":["report"]},{"url":"https://bugzilla.suse.com/967671","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2131","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-2131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2131","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-2131","description":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.","status":"published","published":"2015-01-04T21:00:00Z","modified":"2024-08-06T15:27:40.821Z","updated_at":"2026-11-02T14:34:55.825574Z"}],"euvd":[{"id":"EUVD-2013-2099","description":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.","status":"published","published":"2015-01-04T21:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-fw9w-xf98-wvqv","title":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows...","description":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.","status":"published","published":"2022-05-17T04:13:17Z","modified":"2023-01-28T05:01:20Z","cwes":["CWE-134"],"updated_at":"2026-11-02T14:43:32.807122Z"}],"nvd":[{"id":"CVE-2013-2131","description":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.","status":"published","published":"2015-01-04T21:59:00.057Z","modified":"2026-06-16T23:52:48.27Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:02:51.408338Z"}],"osv":[{"id":"CVE-2013-2131","description":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.","status":"published","published":"2015-01-04T21:59:00Z","modified":"2026-04-10T03:43:20.687583Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2131","description":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.","status":"published","published":"2015-01-04T21:59:00.057Z","modified":"2026-09-01T20:03:16.137600542Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"openSUSE-SU-2024:10163-1","title":"lua-rrdtool-1.6.0-1.1 on GA media","description":"These are all security issues fixed in the lua-rrdtool-1.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:15.315447Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2017:0103-1","title":"Security update for rrdtool","description":"\nThis update for rrdtool provides the following fixes:\n\n- CVE-2013-2131: Enhance imginfo format validation checks to prevent crashes. (bsc#828003)\n- Add rrdtool-cached sub-package to SLE 12-SP1. (bsc#967671)\n","status":"published","published":"2017-01-10T16:26:18Z","modified":"2026-02-04T03:29:34.400145Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"UBUNTU-CVE-2013-2131","description":"Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.","status":"published","published":"2015-01-04T21:59:00Z","modified":"2026-04-22T09:24:14.162556Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}