{"id":"CVE-2013-7290","aliases":["DEBIAN-CVE-2013-7290","EUVD-2013-7067","GHSA-73g2-74h6-466w","MGASA-2014-0018","SUSE-SU-2018:0778-1","SUSE-SU-2018:0807-1","openSUSE-SU-2024:10021-1"],"status":"published","title":"The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when...","description":"The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.","severity":{"version":"2.0","score":1.8,"vector":"AV:A/AC:H/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00931,"percentile":0.6086,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-01-13T21:00:00Z","modified":"2026-09-01T20:03:19Z","fixes":[{"ecosystem":"Debian:12","package":"memcached","fixed_in":["1.4.13-0.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"memcached","fixed_in":["1.4.13-0.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"memcached","fixed_in":["1.4.13-0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-0.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-0.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-0.2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.17-1.mga3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-3.3.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-3.3.2"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.39-3.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-1.1"}]}],"bundled":9}],"products":[{"vendor":"memcached","product":"memcached"}],"references":[{"url":"https://code.google.com/p/memcached/wiki/ReleaseNotes1417","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.securityfocus.com/bid/64988","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://code.google.com/p/memcached/issues/detail?id=306","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7290"},{"url":"https://github.com/advisories/GHSA-73g2-74h6-466w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-7290","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0018.html","tags":["advisory"]},{"url":"http://www.debian.org/security/2014/dsa-2832","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12156","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180778-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1007869","tags":["report"]},{"url":"https://bugzilla.suse.com/1007870","tags":["report"]},{"url":"https://bugzilla.suse.com/1007871","tags":["report"]},{"url":"https://bugzilla.suse.com/1056865","tags":["report"]},{"url":"https://bugzilla.suse.com/798458","tags":["report"]},{"url":"https://bugzilla.suse.com/817781","tags":["report"]},{"url":"https://bugzilla.suse.com/857188","tags":["report"]},{"url":"https://bugzilla.suse.com/858676","tags":["report"]},{"url":"https://bugzilla.suse.com/858677","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-7291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8706","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9951","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180807-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1494","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-7290","description":"The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.","status":"published","published":"2014-01-13T21:00:00Z","modified":"2024-08-06T18:01:20.308Z","updated_at":"2026-11-02T14:34:59.222149Z"}],"euvd":[{"id":"EUVD-2013-7067","description":"The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.","status":"published","published":"2014-01-13T21:00:00Z","modified":"2024-08-06T18:01:20Z","updated_at":"2026-11-03T01:56:23.942036Z"}],"ghsa":[{"id":"GHSA-73g2-74h6-466w","title":"The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when...","description":"The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.","status":"published","published":"2022-05-14T03:35:51Z","modified":"2023-02-02T05:08:45Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:45.777625Z"}],"nvd":[{"id":"CVE-2013-7290","description":"The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.","status":"published","published":"2014-01-13T21:55:05.26Z","modified":"2026-06-17T00:01:40.38Z","cvss":[{"version":"2.0","score":1.8,"vector":"AV:A/AC:H/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"CVE-2013-7290","description":"The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.","status":"published","published":"2014-01-13T21:55:05Z","modified":"2026-04-16T06:17:02.875815688Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-7290","description":"The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.","status":"published","published":"2014-01-13T21:55:05.26Z","modified":"2026-09-01T20:03:19.265888283Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"MGASA-2014-0018","title":"Updated memcached package fixes multiple security vulnerabilities","description":"Updated memcached packages fix security vulnerability:\n\nIt was reported that SASL authentication could be bypassed due to a flaw\nrelated to the managment of the SASL authentication state. With a specially\ncrafted request, a remote attacker may be able to authenticate with invalid\nSASL credentials (CVE-2013-7239).\n\nMultiple issues in memcached before 1.4.17 which allow remote attackers to\ncause a denial of service by sending a request that causes a crash when\nmemcached is running in verbose mode (CVE-2013-0179, CVE-2013-7290,\nCVE-2013-7291).\n","status":"published","published":"2014-01-21T16:14:47Z","modified":"2026-04-16T06:25:58.664641846Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10021-1","title":"memcached-1.4.33-1.1 on GA media","description":"These are all security issues fixed in the memcached-1.4.33-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:05:40.069602Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2018:0778-1","title":"Security update for memcached","description":"This update for memcached fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2011-4971: remote DoS (bsc#817781).\n- CVE-2013-0179: DoS when printing out keys to be deleted in  verbose mode (bsc#798458).\n- CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).\n- CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).\n- CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).\n- CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).\n- CVE-2016-8705: Server update remote code execution (bsc#1007870).\n- CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).\n- CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).\n","status":"published","published":"2018-03-22T13:15:48Z","modified":"2026-02-04T04:08:13.355547Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0807-1","title":"Security update for memcached","description":"This update for memcached fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2011-4971: remote DoS (bsc#817781).\n- CVE-2013-0179: DoS when printing out keys to be deleted in  verbose mode (bsc#798458).\n- CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).\n- CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).\n- CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).\n- CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).\n- CVE-2016-8705: Server update remote code execution (bsc#1007870).\n- CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).\n- CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).\n","status":"published","published":"2018-03-26T09:47:34Z","modified":"2026-02-04T03:07:58.794706Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}