CVE-2013-4143
Status: ModifiedLow (2.1)—
The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts.
CVSS
- Version: 2.0
- Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
- Base score: 2.1
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.40%
- Percentile among all scored CVEs: 32
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- NVD-CWE-Other
References
- http://openwall.com/lists/oss-security/2013/07/16/8
- http://openwall.com/lists/oss-security/2013/07/18/6
- http://www.tux.org/~bagleyd/xlock/xlockmore.README
- http://openwall.com/lists/oss-security/2013/07/16/8
- http://openwall.com/lists/oss-security/2013/07/18/6
- http://www.tux.org/~bagleyd/xlock/xlockmore.README
Raw JSON (NVD)
Show
{
"id": "CVE-2013-4143",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 2.1,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2014-05-30T14:55:08.257",
"references": [
{
"url": "http://openwall.com/lists/oss-security/2013/07/16/8",
"source": "secalert@redhat.com"
},
{
"url": "http://openwall.com/lists/oss-security/2013/07/18/6",
"source": "secalert@redhat.com"
},
{
"url": "http://www.tux.org/~bagleyd/xlock/xlockmore.README",
"tags": [
"Vendor Advisory"
],
"source": "secalert@redhat.com"
},
{
"url": "http://openwall.com/lists/oss-security/2013/07/16/8",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://openwall.com/lists/oss-security/2013/07/18/6",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.tux.org/~bagleyd/xlock/xlockmore.README",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The (1) checkPasswd and (2) checkGroupXlockPasswds functions in xlockmore before 5.43 do not properly handle when a NULL value is returned upon an error by the crypt or dispcrypt function as implemented in glibc 2.17 and later, which allows attackers to bypass the screen lock via vectors related to invalid salts."
},
{
"lang": "es",
"value": "Las funciones (1) checkPasswd y (2) checkGroupXlockPasswds en xlockmore anterior a 5.43 no se manejan debidamente cuando un valor nulo está devuelto en un error por la función crypt o dispcrypt tal y como está implementado en glibc 2.17 y posteriores, lo que permite a atacantes evadir el bloqueo de pantalla a través de vectores relacionados con salts inválidos."
}
],
"lastModified": "2026-06-16T23:56:42.107",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E616802-AE2E-4659-85A2-C0F52B69F333",
"versionEndIncluding": "5.42"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.24:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "688E5398-EEEE-496F-9540-A666410A8E8B"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.25:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE0242C8-5BD8-4F1E-9E35-6672DEC7C66C"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.26:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A071A240-6024-4D7A-8172-AF53550D451B"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.27:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54AF7E13-5892-47F3-BE14-8F2F7982F31C"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.28:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9EF8C2D-30A2-4602-9BEE-D9502CC3A3B1"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.29:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "22534189-F40E-4073-9028-CAB6ACBC39D3"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.30:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "84701664-C659-4347-9F13-F0CDCE08CA71"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.31:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF3D0BE2-DBB6-40BA-92AF-AE4E2EFFCA1F"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.32:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3698DA33-BB9E-4473-8CD2-950314668615"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.33:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB90F6FE-C8A0-4B07-A6FB-53584EB7B426"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.34:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4A6AEFC-42A5-468A-960D-DD53624A1687"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.35:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55C5B941-D793-4DFA-8F80-18BDA427445E"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.36:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A5DEDA8B-6575-44D8-97D5-043E21F49982"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.37:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FED4EE4B-266D-40A2-99C3-51A4EB72A5D8"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.38:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7EB050A6-C0BB-416C-9972-69CF4056DC85"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.39:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "244178C6-AB99-4E9C-ADD3-BDE537FDE551"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.40:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C40F0F8-86BC-4DB6-A0B5-63DED3744178"
},
{
"criteria": "cpe:2.3:a:david_bagley:xlockmore:5.41:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3EBDA64-B0BA-45F9-8483-4936121864AC"
}
],
"operator": "OR"
}
]
}
],
"evaluatorComment": "per http://cwe.mitre.org/data/definitions/476.html\n\n\"CWE-476: NULL Pointer Dereference\"",
"sourceIdentifier": "secalert@redhat.com"
}