{"id":"CVE-2013-4143","aliases":["EUVD-2013-4070","GHSA-jcgx-qjj8-pgf8","MGASA-2013-0225","openSUSE-SU-2024:10134-1"],"status":"published","title":"The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not...","description":"The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00397,"percentile":0.34189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-07-21T09:31:57Z","modified":"2026-06-16T23:56:42Z","fixes":[{"ecosystem":"Mageia:3","package":"xlockmore","fixed_in":["5.41-2.1.mga3"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xlockmore","fixed_in":["5.45-3.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:3","package":"xlockmore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.41-2.1.mga3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xlockmore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.45-3.8"}]}]}],"products":[{"vendor":"david_bagley","product":"xlockmore"}],"references":[{"url":"http://www.tux.org/~bagleyd/xlock/xlockmore.README","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://openwall.com/lists/oss-security/2013/07/18/6","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://openwall.com/lists/oss-security/2013/07/16/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4143"},{"url":"https://github.com/advisories/GHSA-jcgx-qjj8-pgf8"},{"url":"https://advisories.mageia.org/MGASA-2013-0225.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=10799","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4143","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4143","description":"The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts.","status":"published","published":"2014-05-30T14:00:00Z","modified":"2024-08-06T16:30:49.987Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4070","description":"The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts.","status":"published","published":"2014-05-30T14:00:00Z","modified":"2024-08-06T16:30:49Z","updated_at":"2026-11-03T01:56:33.227006Z"}],"ghsa":[{"id":"GHSA-jcgx-qjj8-pgf8","title":"The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not...","description":"The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts.","status":"published","published":"2022-05-17T04:41:03Z","modified":"2023-01-28T05:02:18Z","updated_at":"2026-11-02T14:43:45.385Z"}],"nvd":[{"id":"CVE-2013-4143","description":"The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts.","status":"published","published":"2014-05-30T14:55:08.257Z","modified":"2026-06-16T23:56:42.107Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"MGASA-2013-0225","title":"Updated xlockmore package fixes security vulnerability","description":"xlockmore before 5.43 contains a security flaw related to potential NULL\npointer dereferences when authenticating via glibc 2.17+'s crypt() function.\nUnder certain conditions the NULL pointers can trigger a crash in xlockmore\neffectively bypassing the screen lock (CVE-2013-4143).\n","status":"published","published":"2013-07-21T09:31:57Z","modified":"2026-04-16T06:24:01.892667699Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10134-1","title":"xlockmore-5.45-3.8 on GA media","description":"These are all security issues fixed in the xlockmore-5.45-3.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:53.750616Z","updated_at":"2026-11-02T16:58:33.135986Z"}]}}