CVE-2013-2142

userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local...

3.3 LowFix available

CVE-2013-2142 is a low vulnerability (CVSS 3.3) in Libimobiledevice, published August 17, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in libimobiledevice 1.1.5-0.1.

What does this mean?

Severity: 3.3 LowCVSS 2.0, NVD
Exploit chance: 0.27%EPSS, 18th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 1.1.5-0.1libimobiledevice +3 more

Description

userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.

Exploit likelihood

0.27%Down 0.7 points since Feb 4, 2022

Affected products

libimobiledevice

Affected packages

Affected packages
Package	Affected	Fixed
`libimobiledevice` Debian:12	before 1.1.5-0.1	1.1.5-0.1
`libimobiledevice` Debian:13	before 1.1.5-0.1	1.1.5-0.1
`libimobiledevice` Debian:14	before 1.1.5-0.1	1.1.5-0.1
`libimobiledevice` Mageia:3	before 1.1.4-4.1.mga3	1.1.4-4.1.mga3

What each source reports

NVD Score used3.3

Record: CVE-2013-2142
CVSS 2.0: 3.3 LowAV:L/AC:M/Au:N/C:N/I:P/A:P
Weakness: CWE-59
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2013-2142
Updated: 2026-11-02

EUVDEUVD-2013-2107No score

Record: EUVD-2013-2107
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7wj3-4crv-vhfjNo score

userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local...

Record: GHSA-7wj3-4crv-vhfj
Weakness: CWE-59
Updated: 2026-11-02

OSVNo score

Record: CVE-2013-2142
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-2142No score

Record: DEBIAN-CVE-2013-2142
Updated: 2026-11-02

OSVMGASA-2013-0251No score

Updated libimobiledevice packages fix CVE-2013-2142

Updated libimobiledevice packages fix security vulnerability:

Paul Collins discovered that libimobiledevice incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files and access device keys. In the default Ubuntu installation, this issue should be mitigated by the Yama link restrictions (CVE-2013-2142).

Record: MGASA-2013-0251
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10459-1No score

imobiledevice-tools-1.2.0-3.4 on GA media

These are all security issues fixed in the imobiledevice-tools-1.2.0-3.4 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10459-1
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 6, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 6 moreShow less