Read the docs
TI-2013-00219 Aliases CVE-2013-0288GHSA-rw67-8982-w823

nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to…

Priority LOW 36CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.

Why it matters now

EPSS 0.03582 89th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 52

CPEVersionsRoleVendor
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.0:*:*:*:*:*:*:*0.8.0VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.1:*:*:*:*:*:*:*0.8.1VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.2:*:*:*:*:*:*:*0.8.2VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.3:*:*:*:*:*:*:*0.8.3VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.4:*:*:*:*:*:*:*0.8.4VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.5:*:*:*:*:*:*:*0.8.5VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.6:*:*:*:*:*:*:*0.8.6VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.7:*:*:*:*:*:*:*0.8.7VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.8:*:*:*:*:*:*:*0.8.8VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.9:*:*:*:*:*:*:*0.8.9VulnerableArthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.0:*:*:*:*:*:*:* Versions 0.8.0 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.1:*:*:*:*:*:*:* Versions 0.8.1 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.2:*:*:*:*:*:*:* Versions 0.8.2 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.3:*:*:*:*:*:*:* Versions 0.8.3 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.4:*:*:*:*:*:*:* Versions 0.8.4 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.5:*:*:*:*:*:*:* Versions 0.8.5 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.6:*:*:*:*:*:*:* Versions 0.8.6 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.7:*:*:*:*:*:*:* Versions 0.8.7 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.8:*:*:*:*:*:*:* Versions 0.8.8 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.9:*:*:*:*:*:*:* Versions 0.8.9 Vulnerable ·Arthurdejong
Show 42 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.10:*:*:*:*:*:*:*0.8.10VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:*:*:*:*:*:*:*:*up to 0.7.17VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.1:*:*:*:*:*:*:*0.1VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.2:*:*:*:*:*:*:*0.2VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.2.1:*:*:*:*:*:*:*0.2.1VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.3:*:*:*:*:*:*:*0.3VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.4:*:*:*:*:*:*:*0.4VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.4.1:*:*:*:*:*:*:*0.4.1VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.5:*:*:*:*:*:*:*0.5VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6:*:*:*:*:*:*:*0.6VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.0:*:*:*:*:*:*:*0.6.0VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.1:*:*:*:*:*:*:*0.6.1VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.2:*:*:*:*:*:*:*0.6.2VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.3:*:*:*:*:*:*:*0.6.3VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.4:*:*:*:*:*:*:*0.6.4VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.5:*:*:*:*:*:*:*0.6.5VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.6:*:*:*:*:*:*:*0.6.6VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.7:*:*:*:*:*:*:*0.6.7VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.7.1:*:*:*:*:*:*:*0.6.7.1VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.7.2:*:*:*:*:*:*:*0.6.7.2VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.8:*:*:*:*:*:*:*0.6.8VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.9:*:*:*:*:*:*:*0.6.9VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.10:*:*:*:*:*:*:*0.6.10VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.11:*:*:*:*:*:*:*0.6.11VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.12:*:*:*:*:*:*:*0.6.12VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.0:*:*:*:*:*:*:*0.7.0VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.1:*:*:*:*:*:*:*0.7.1VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.2:*:*:*:*:*:*:*0.7.2VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.3:*:*:*:*:*:*:*0.7.3VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.4:*:*:*:*:*:*:*0.7.4VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.5:*:*:*:*:*:*:*0.7.5VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.6:*:*:*:*:*:*:*0.7.6VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.7:*:*:*:*:*:*:*0.7.7VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.8:*:*:*:*:*:*:*0.7.8VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.9:*:*:*:*:*:*:*0.7.9VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.10:*:*:*:*:*:*:*0.7.10VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.11:*:*:*:*:*:*:*0.7.11VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.12:*:*:*:*:*:*:*0.7.12VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.13:*:*:*:*:*:*:*0.7.13VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.14:*:*:*:*:*:*:*0.7.14VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.15:*:*:*:*:*:*:*0.7.15VulnerableArthurdejong
cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.16:*:*:*:*:*:*:*0.7.16VulnerableArthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.8.10:*:*:*:*:*:*:* Versions 0.8.10 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:*:*:*:*:*:*:*:* Versions up to 0.7.17 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.2.1:*:*:*:*:*:*:* Versions 0.2.1 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.4.1:*:*:*:*:*:*:* Versions 0.4.1 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.1:*:*:*:*:*:*:* Versions 0.6.1 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.2:*:*:*:*:*:*:* Versions 0.6.2 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.3:*:*:*:*:*:*:* Versions 0.6.3 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.4:*:*:*:*:*:*:* Versions 0.6.4 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.5:*:*:*:*:*:*:* Versions 0.6.5 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.6:*:*:*:*:*:*:* Versions 0.6.6 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.7:*:*:*:*:*:*:* Versions 0.6.7 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.7.1:*:*:*:*:*:*:* Versions 0.6.7.1 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.7.2:*:*:*:*:*:*:* Versions 0.6.7.2 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.8:*:*:*:*:*:*:* Versions 0.6.8 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.9:*:*:*:*:*:*:* Versions 0.6.9 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.10:*:*:*:*:*:*:* Versions 0.6.10 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.11:*:*:*:*:*:*:* Versions 0.6.11 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.6.12:*:*:*:*:*:*:* Versions 0.6.12 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.0:*:*:*:*:*:*:* Versions 0.7.0 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.1:*:*:*:*:*:*:* Versions 0.7.1 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.2:*:*:*:*:*:*:* Versions 0.7.2 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.3:*:*:*:*:*:*:* Versions 0.7.3 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.4:*:*:*:*:*:*:* Versions 0.7.4 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.5:*:*:*:*:*:*:* Versions 0.7.5 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.6:*:*:*:*:*:*:* Versions 0.7.6 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.7:*:*:*:*:*:*:* Versions 0.7.7 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.8:*:*:*:*:*:*:* Versions 0.7.8 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.9:*:*:*:*:*:*:* Versions 0.7.9 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.10:*:*:*:*:*:*:* Versions 0.7.10 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.11:*:*:*:*:*:*:* Versions 0.7.11 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.12:*:*:*:*:*:*:* Versions 0.7.12 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.13:*:*:*:*:*:*:* Versions 0.7.13 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.14:*:*:*:*:*:*:* Versions 0.7.14 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.15:*:*:*:*:*:*:* Versions 0.7.15 Vulnerable ·Arthurdejong
  • cpe:2.3:a:arthurdejong:nss-pam-ldapd:0.7.16:*:*:*:*:*:*:* Versions 0.7.16 Vulnerable ·Arthurdejong

Remediation

Red Hat 1 advisory

  • RHSA-2013:0590 Released 2013-03-04 · Red Hat rating Important
    nss-pam-ldapd security update
    • Red Hat Enterprise Linux Desktop (v. 6) nss-pam-ldapd-0.7.5-18.1.el6_4
    • Red Hat Enterprise Linux HPC Node (v. 6) nss-pam-ldapd-0.7.5-18.1.el6_4
    • Red Hat Enterprise Linux Server (v. 6) nss-pam-ldapd-0.7.5-18.1.el6_4, nss-pam-ldapd-0.7.5-18.1.el6_4.ppc
    • Red Hat Enterprise Linux Workstation (v. 6) nss-pam-ldapd-0.7.5-18.1.el6_4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2013:0590
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2013:0590
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2013:0590
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2013:0590

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-0288
  2. 2026-10-03 Alias added: GHSA-rw67-8982-w823

References

Advisory 6

Other 8

  • TI-2011-00365 nslcd/pam.c in the nss-pam-ldapd 0.8.0 PAM module returns a success code when a user is… CVSS 2.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences