CVE catalog

CVE-2013-7108

UBUNTU-CVE-2013-7108

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
61.63% · Oct 27, 2026

Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntunagios314.043.4.1-5ubuntu2vulnerable
Ubuntunagios314.043.4.1-5ubuntu3vulnerable
Ubuntunagios314.043.5.1-1ubuntu1vulnerable
Ubuntunagios314.043.5.1-1ubuntu1.1fixed
Ubuntunagios316.043.5.1-1ubuntu4vulnerable
Ubuntunagios316.043.5.1.dfsg-2ubuntu1vulnerable
Ubuntunagios316.043.5.1.dfsg-2ubuntu2vulnerable
Ubuntunagios316.043.5.1.dfsg-2.1ubuntu1vulnerable
Ubuntunagios316.043.5.1.dfsg-2.1ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Ubuntunagios3deb14.043.5.1-1ubuntu1.1Not reportedUBUNTU-CVE-2013-7108Not reported
Ubuntunagios3deb16.043.5.1.dfsg-2.1ubuntu1.1Not reportedUBUNTU-CVE-2013-7108Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]