{"id":"CVE-2013-4331","aliases":["DEBIAN-CVE-2013-4331","EUVD-2013-4217","GHSA-p375-56p4-h24r","MGASA-2013-0286"],"status":"published","title":"Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7...","description":"Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00368,"percentile":0.30929,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-09-19T09:46:09Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"lightdm","fixed_in":["1.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lightdm","fixed_in":["1.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lightdm","fixed_in":["1.6.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"lightdm","fixed_in":["1.4.3-1.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lightdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lightdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lightdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"lightdm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-1.mga3"}]}]}],"products":[{"vendor":"robert_ancell","product":"lightdm"}],"references":[{"url":"https://bugs.launchpad.net/lightdm/%2Bbug/685212","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4331"},{"url":"https://github.com/advisories/GHSA-p375-56p4-h24r"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4331","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0286.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11219","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11071","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2013/09/11/4","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4331","description":"Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.","status":"published","published":"2014-02-02T00:00:00Z","modified":"2024-08-06T16:38:02.156Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4217","description":"Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.","status":"published","published":"2014-02-02T00:00:00Z","modified":"2024-08-06T16:38:02Z","updated_at":"2026-11-03T01:56:32.187151Z"}],"ghsa":[{"id":"GHSA-p375-56p4-h24r","title":"Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7...","description":"Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.","status":"published","published":"2022-05-17T04:53:42Z","modified":"2023-01-28T05:02:45Z","updated_at":"2026-11-02T14:43:50.187003Z"}],"nvd":[{"id":"CVE-2013-4331","description":"Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.","status":"published","published":"2014-02-02T00:55:04.46Z","modified":"2026-06-16T23:57:02.56Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"CVE-2013-4331","description":"Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.","status":"published","published":"2014-02-02T00:55:04Z","modified":"2026-04-16T06:22:41.011198124Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4331","description":"Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.","status":"published","published":"2014-02-02T00:55:04.46Z","modified":"2026-09-01T20:03:18.09977915Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0286","title":"Updated lightdm package fixes security vulnerability","description":"lightdm before 1.4.3, 1.6.2 and 1.7.14 created .Xauthority files with\nworld-readable permissions (CVE-2013-4331).\n\nAdditionally, an issue where a user logged into a graphical desktop\nenvironment through lightdm would lose privleges to local devices (such as\nthe sound card) when using the 'su' command has been fixed.\n","status":"published","published":"2013-09-19T09:46:09Z","modified":"2026-04-16T06:22:35.843476521Z","updated_at":"2026-11-02T15:49:39.121227Z"}]}}