What’s Vulnerable › Vulnerabilities

CVE-2013-4365

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 13.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-10-17 · updated 2026-06-16
• Weakness: CWE-787

Description

Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.

Affected products

• Apache Mod Fcgid: before 2.3.9 — fixed in 2.3.9
• Debian Linux: 6.0, 7.0
• Opensuse: 11.4, 12.2, 12.3
• SUSE Cloud: 1.0, 2.0
• SUSE Linux Enterprise Software Development Kit: 11-sp2, 11-sp3

How to fix

Upgrade to a fixed version: Apache Mod Fcgid 2.3.9. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00011.html
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00055.html
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00059.html
• http://lists.opensuse.org/opensuse-updates/2013-11/msg00024.html
• http://secunia.com/advisories/55197
• http://svn.apache.org/viewvc?view=revision&revision=1527362
• http://www.debian.org/security/2013/dsa-2778
• http://www.mail-archive.com/dev%40httpd.apache.org/msg58077.html
• http://www.securityfocus.com/bid/62939
• http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00011.html
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00055.html
• http://lists.opensuse.org/opensuse-updates/2013-10/msg00059.html

Get alerted when CVE-2013-4365 or the next vulnerability affects your stack