{"id":"CVE-2013-2298","aliases":["DEBIAN-CVE-2013-2298","EUVD-2013-2244","GHSA-pjjf-j58m-gr8m","MGASA-2014-0460","UBUNTU-CVE-2013-2298"],"status":"published","title":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have...","description":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02583,"percentile":0.85332,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-06-02T15:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"Debian:12","package":"boinc","fixed_in":["7.0.65+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"boinc","fixed_in":["7.0.65+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"boinc","fixed_in":["7.0.65+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"boinc-client","fixed_in":["7.2.42-1.2.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"boinc-client","fixed_in":["7.2.42-1.2.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"boinc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.65+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"boinc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.65+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"boinc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.65+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"boinc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.42-1.2.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"boinc-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.42-1.2.mga4"}]}]}],"products":[{"vendor":"universityofcalifornia","product":"boinc_client"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/04/28/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125125.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/53192","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/83931","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git%3Ba=commitdiff%3Bh=2fea03824925cbcb976f4191f4d8321e41a4d95b","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://thread.gmane.org/gmane.comp.distributed.boinc.user/3741","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2013-December/125128.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/59539","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2298"},{"url":"http://boinc.berkeley.edu/gitweb/?p=boinc-v2.git;a=commitdiff;h=2fea03824925cbcb976f4191f4d8321e41a4d95b","tags":["report"]},{"url":"https://github.com/advisories/GHSA-pjjf-j58m-gr8m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-2298","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0460.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12129","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2013-December/125125.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=9108","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=9109","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-2298","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2013/04/28","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2298","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-2298","description":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.","status":"published","published":"2014-06-02T15:00:00Z","modified":"2024-08-06T15:36:46.433Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2244","description":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.","status":"published","published":"2014-06-02T15:00:00Z","modified":"2024-08-06T15:36:46Z","updated_at":"2026-11-03T01:56:38.734197Z"}],"ghsa":[{"id":"GHSA-pjjf-j58m-gr8m","title":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have...","description":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.","status":"published","published":"2022-05-17T01:36:04Z","modified":"2025-04-12T12:34:22Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:17.411211Z"}],"nvd":[{"id":"CVE-2013-2298","description":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.","status":"published","published":"2014-06-02T15:55:10.06Z","modified":"2026-06-16T23:53:05.577Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"CVE-2013-2298","description":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.","status":"published","published":"2014-06-02T15:55:10Z","modified":"2026-04-16T06:25:08.044813848Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-2298","description":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.","status":"published","published":"2014-06-02T15:55:10.06Z","modified":"2026-09-01T20:03:15.885568692Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2014-0460","title":"Updated boinc-client packages fix security vulnerability","description":"Multiple stack overflow flaws were found in the way the XML parser of\nboinc-client, a Berkeley Open Infrastructure for Network Computing (BOINC)\nclient for distributed computing, performed processing of certain XML files.\nA rogue BOINC server could provide a specially-crafted XML file that, when\nprocessed would lead to boinc-client executable crash (CVE-2013-2298).\n\nIssues preventing the boinc-client service from working immediately after\ninstallation have been fixed as well.\n","status":"published","published":"2014-11-21T12:44:16Z","modified":"2026-04-16T06:26:31.62240898Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2013-2298","description":"Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.","status":"withdrawn","published":"2014-06-02T15:55:00Z","modified":"2025-07-16T07:31:15.980543Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}