{"id":"CVE-2013-4559","aliases":["DEBIAN-CVE-2013-4559","DSA-2795-1","EUVD-2013-4418","GHSA-pfcc-94ff-p2cv","MGASA-2013-0334","UBUNTU-CVE-2013-4559","openSUSE-SU-2024:10402-1"],"status":"published","title":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3)...","description":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.","severity":{"version":"2.0","score":7.6,"vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.10721,"percentile":0.9585,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-11-13T00:00:00Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"lighttpd","fixed_in":["1.4.33-1+nmu1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lighttpd","fixed_in":["1.4.33-1+nmu1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lighttpd","fixed_in":["1.4.33-1+nmu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-1+nmu1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-1+nmu1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-1+nmu1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.28-2+squeeze1.4"}]}],"versions":["1.4.28-2","1.4.28-2+squeeze1","1.4.28-2+squeeze1.1","1.4.28-2+squeeze1.2","1.4.28-2+squeeze1.3"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.31-4+deb7u1"}]}],"versions":["1.4.31-4"],"bundled":3},{"source":"osv","ecosystem":"Mageia:2","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.30-5.3.mga2"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:3","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.32-3.6.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lighttpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.37-1.6"}]}],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"lighttpd","product":"lighttpd"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://secunia.com/advisories/55682","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=141576815022399\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_02.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://www.debian.org/security/2013/dsa-2795","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/11/12/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10310","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://jvn.jp/en/jp/JVN37417423/index.html","tags":["third-party-advisory","x_refsource_JVN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4559"},{"url":"https://github.com/advisories/GHSA-pfcc-94ff-p2cv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4559","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0334.html","tags":["advisory"]},{"url":"http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_01.txt","tags":["web"]},{"url":"http://download.lighttpd.net/lighttpd/security/lighttpd_sa_2013_03.txt","tags":["web"]},{"url":"http://www.debian.org/security/2013/dsa-2795","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4559","tags":["report"]},{"url":"http://lists.debian.org/debian-security-announce/2013/msg00207.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4559","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-5533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2324","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4559","description":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.","status":"published","published":"2013-11-19T19:00:00Z","modified":"2024-08-06T16:45:14.842Z","updated_at":"2026-11-02T14:34:57.499208Z"}],"euvd":[{"id":"EUVD-2013-4418","description":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.","status":"published","published":"2013-11-19T19:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.667445Z"}],"ghsa":[{"id":"GHSA-pfcc-94ff-p2cv","title":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3)...","description":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.","status":"published","published":"2022-05-13T01:11:38Z","modified":"2023-02-01T05:03:46Z","updated_at":"2026-11-02T14:50:06.238998Z"}],"nvd":[{"id":"CVE-2013-4559","description":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.","status":"published","published":"2013-11-20T14:12:30.727Z","modified":"2026-06-16T23:57:27.147Z","cvss":[{"version":"2.0","score":7.6,"vector":"AV:N/AC:H/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:40.988689Z"}],"osv":[{"id":"CVE-2013-4559","description":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.","status":"published","published":"2013-11-20T14:12:30Z","modified":"2026-04-16T06:19:55.122912498Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4559","description":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.","status":"published","published":"2013-11-20T14:12:30.727Z","modified":"2026-09-01T20:03:18.43492298Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2795-1","title":"lighttpd - several","status":"published","published":"2013-11-13T00:00:00Z","modified":"2026-03-09T01:22:21.652117Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"MGASA-2013-0334","title":"Updated lighttpd packages fix multiple security vulnerbilities","description":"Updated lighttpd packages fix security vulnerabilities:\n\nlighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which\nmakes it easier for remote attackers to hijack sessions by inserting packets\ninto the client-server data stream or obtain sensitive information by sniffing\nthe network (CVE-2013-4508).\n\nIn lighttpd before 1.4.34, if setuid() fails for any reason, for instance if an\nenvironment limits the number of processes a user can have and the target uid\nalready is at the limit, lighttpd will run as root. A user who can run CGI\nscripts could clone() often; in this case a lighttpd restart would end up with\nlighttpd running as root, and the CGI scripts would run as root too\n(CVE-2013-4559).\n\nIn lighttpd before 1.4.34, if \"fam\" is enabled and there are directories\nreachable from configured doc roots and aliases on which FAMMonitorDirectory\nfails, a remote client could trigger a DoS (CVE-2013-4560).\n","status":"published","published":"2013-11-20T20:36:53Z","modified":"2026-04-16T06:22:53.685442065Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10402-1","title":"lighttpd-1.4.37-1.6 on GA media","description":"These are all security issues fixed in the lighttpd-1.4.37-1.6 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:30:23.176601Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"UBUNTU-CVE-2013-4559","description":"lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.","status":"withdrawn","published":"2013-11-20T14:12:00Z","modified":"2025-07-16T08:10:47.689679Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}