CVE-2013-2004

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-06-15 · updated 2026-06-16
Weakness: CWE-119

Description

The (1) GetDatabase and (2) _XimParseStringFile functions in X.org libX11 1.5.99.901 (1.6 RC1) and earlier do not restrict the recursion depth when processing directives to include files, which allows X servers to cause a denial of service (stack consumption) via a crafted file.

Affected products

X Libx11: through 1.5.99.901; 1.5.0

References

http://www.debian.org/security/2013/dsa-2693
http://www.openwall.com/lists/oss-security/2013/05/23/3
http://www.ubuntu.com/usn/USN-1854-1
http://www.x.org/wiki/Development/Security/Advisory-2013-05-23
http://www.debian.org/security/2013/dsa-2693
http://www.openwall.com/lists/oss-security/2013/05/23/3
http://www.ubuntu.com/usn/USN-1854-1
http://www.x.org/wiki/Development/Security/Advisory-2013-05-23

Get alerted when CVE-2013-2004 or the next vulnerability affects your stack