VIR Vulnerability Intelligence Relay

CVE-2013-1427

low
Published 2013-03-21 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
1.9

Description

The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed1.4.31-4
debian debianbullseyefixed1.4.31-4
debian debianforkyfixed1.4.31-4
debian debiansidfixed1.4.31-4
debian debiantrixiefixed1.4.31-4
debian debiannot-affected

Application impact
VendorProductVersionsFixed
lighttpdlighttpd{"endIncluding":"1.4.27"}
lighttpdlighttpd1.3.16
lighttpdlighttpd1.4.3
lighttpdlighttpd1.4.4
lighttpdlighttpd1.4.5
lighttpdlighttpd1.4.6
lighttpdlighttpd1.4.7
lighttpdlighttpd1.4.8
lighttpdlighttpd1.4.9
lighttpdlighttpd1.4.10
lighttpdlighttpd1.4.11
lighttpdlighttpd1.4.12
lighttpdlighttpd1.4.13
lighttpdlighttpd1.4.15
lighttpdlighttpd1.4.16
lighttpdlighttpd1.4.18
lighttpdlighttpd1.4.19
lighttpdlighttpd1.4.20
lighttpdlighttpd1.4.21
lighttpdlighttpd1.4.22
lighttpdlighttpd1.4.23
lighttpdlighttpd1.4.24
lighttpdlighttpd1.4.25
lighttpdlighttpd1.4.26

References

CWEs

CWE-310

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.