{"id":"CVE-2013-7108","aliases":["DLA-1615-1","DLA-60-1","DSA-2956-1","EUVD-2013-6894","GHSA-48qr-xf75-jc6h","MGASA-2014-0010","UBUNTU-CVE-2013-7108","USN-3253-1","openSUSE-SU-2024:10182-1","openSUSE-SU-2024:11073-1"],"status":"published","title":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9...","description":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.","severity":{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.61625,"percentile":0.99175,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2014-01-14T18:00:00Z","modified":"2026-06-17T00:01:25Z","exploits":[{"source":"exploitdb","id":"EDB-38882","title":"Icinga - cgi/config.c process_cgivars Function Off-by-One Read Remote Denial of Service","type":"dos","platform":"cgi","date":"2013-12-16","verified":true,"url":"https://www.exploit-db.com/exploits/38882"}],"fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"nagios3","fixed_in":["3.5.1-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"nagios3","fixed_in":["3.5.1.dfsg-2.1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:8","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1.dfsg-2+deb8u1"}]}],"versions":["3.5.1.dfsg-2"],"bundled":5},{"source":"osv","ecosystem":"Debian:6.0","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2+squeeze2"}]}],"versions":["1.0.2-2","1.0.2-2+squeeze1"],"bundled":2},{"source":"osv","ecosystem":"Debian:7","package":"icinga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-7"}]}],"versions":["1.7.1-6"],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-4.2.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1ubuntu1.1"}]}],"versions":["3.4.1-5ubuntu2","3.4.1-5ubuntu3","3.5.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1.dfsg-2.1ubuntu1.1"}]}],"versions":["3.5.1-1ubuntu4","3.5.1.dfsg-2ubuntu1","3.5.1.dfsg-2ubuntu2","3.5.1.dfsg-2.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1ubuntu1.1"}]}],"versions":["3.4.1-5ubuntu2","3.4.1-5ubuntu3","3.5.1-1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nagios3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1.dfsg-2.1ubuntu1.1"}]}],"versions":["3.5.1-1ubuntu4","3.5.1.dfsg-2ubuntu1","3.5.1.dfsg-2ubuntu2","3.5.1.dfsg-2.1ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nagios","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.6-2.5"}]}],"bundled":17}],"products":[{"vendor":"icinga","product":"icinga"},{"vendor":"nagios","product":"nagios"}],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:004","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://secunia.com/advisories/56316","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00068.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://dev.icinga.org/issues/5251","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/12/msg00014.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2013/12/24/1","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://secunia.com/advisories/55976","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/64363","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-01/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7108"},{"url":"https://www.icinga.org/2013/12/17/icinga-security-releases-1-10-2-1-9-4-1-8-5"},{"url":"http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866"},{"url":"https://github.com/advisories/GHSA-48qr-xf75-jc6h"},{"url":"https://advisories.mageia.org/MGASA-2014-0010.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12100","tags":["report"]},{"url":"https://secunia.com/advisories/55976/","tags":["advisory"]},{"url":"http://openwall.com/lists/oss-security/2013/12/24/1","tags":["web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1046113","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7108","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3253-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7108","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7205","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1878","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-9566","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2012-6096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-2162","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13977","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-7108","description":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.","status":"published","published":"2014-01-14T18:00:00Z","modified":"2024-08-06T18:01:19.334Z","updated_at":"2026-11-02T14:34:59.222149Z"}],"euvd":[{"id":"EUVD-2013-6894","description":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.","status":"published","published":"2014-01-14T18:00:00Z","modified":"2024-08-06T18:01:19Z","updated_at":"2026-11-03T01:56:24.379982Z"}],"ghsa":[{"id":"GHSA-48qr-xf75-jc6h","title":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9...","description":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.","status":"published","published":"2022-05-14T01:45:50Z","modified":"2025-04-11T04:18:56Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:15.391359Z"}],"nvd":[{"id":"CVE-2013-7108","description":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.","status":"published","published":"2014-01-15T16:08:04.017Z","modified":"2026-06-17T00:01:25.993Z","cvss":[{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"DLA-1615-1","title":"nagios3 - security update","status":"published","published":"2018-12-24T00:00:00Z","modified":"2026-03-09T01:18:24.058758Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-60-1","title":"icinga - security update","status":"published","published":"2014-09-24T00:00:00Z","modified":"2026-03-09T02:11:39.134608Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-2956-1","title":"icinga - security update","status":"published","published":"2014-06-11T00:00:00Z","modified":"2026-03-09T01:18:14.344727Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0010","title":"Updated nagios package fixes security vulnerability","description":"A flaw was reported and fixed in Nagios, which can be exploited to cause a\ndenial of service.  This vulnerability is caused due to an off-by-one\nerror within the process_cgivars() function, which can be exploited to\ncause an out-of-bounds read by sending a specially-crafted key value to the Nagios\nweb UI (CVE-2013-7108, CVE-2013-7205).\nAn issue that prevented the service from starting has also been fixed.\n","status":"published","published":"2014-01-17T00:22:05Z","modified":"2026-04-16T06:23:27.322468609Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10182-1","title":"icinga-1.13.3-2.4 on GA media","description":"These are all security issues fixed in the icinga-1.13.3-2.4 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:36.443295Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:11073-1","title":"nagios-4.4.6-2.5 on GA media","description":"These are all security issues fixed in the nagios-4.4.6-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:19.000922Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"UBUNTU-CVE-2013-7108","description":"Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.","status":"published","published":"2014-01-15T00:00:00Z","modified":"2026-02-04T02:21:08.815334Z","updated_at":"2026-11-02T15:54:07.421078Z"},{"id":"USN-3253-1","title":"nagios3 vulnerabilities","description":"It was discovered that Nagios incorrectly handled certain long strings. A\nremote authenticated attacker could use this issue to cause Nagios to\ncrash, resulting in a denial of service, or possibly obtain sensitive\ninformation. (CVE-2013-7108, CVE-2013-7205)\n\nIt was discovered that Nagios incorrectly handled certain long messages to\ncmd.cgi. A remote attacker could possibly use this issue to cause Nagios to\ncrash, resulting in a denial of service. (CVE-2014-1878)\n\nDawid Golunski discovered that Nagios incorrectly handled symlinks when\naccessing log files. A local attacker could possibly use this issue to\nelevate privileges. In the default installation of Ubuntu, this should be\nprevented by the Yama link restrictions. (CVE-2016-9566)\n","status":"published","published":"2017-04-03T17:42:28Z","modified":"2026-02-10T04:41:06Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}