CVE-2013-4391

Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large journal data field, which triggers a heap-based buffer overflow.

• CWE-190

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357Issue Tracking, Mailing List, Patch, Third Party Advisory
• http://cgit.freedesktop.org/systemd/systemd/commit/?id=505b6a61c22d5565e9308045c7b9bf79f7d0517eExploit, Patch, Vendor Advisory
• http://www.debian.org/security/2013/dsa-2777Third Party Advisory
• http://www.openwall.com/lists/oss-security/2013/10/01/9Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=859051Issue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201612-34Third Party Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357Issue Tracking, Mailing List, Patch, Third Party Advisory
• http://cgit.freedesktop.org/systemd/systemd/commit/?id=505b6a61c22d5565e9308045c7b9bf79f7d0517eExploit, Patch, Vendor Advisory
• http://www.debian.org/security/2013/dsa-2777Third Party Advisory
• http://www.openwall.com/lists/oss-security/2013/10/01/9Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=859051Issue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201612-34Third Party Advisory

Published

Oct 28, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4385Buffer overflow in the "read-string!" procedure in the "extr…
• CVE-2013-4386Multiple SQL injection vulnerabilities in app/models/concern…
• CVE-2013-4387net/ipv6/ip6_output.c in the Linux kernel through 3.11.4 doe…
• CVE-2013-4388Buffer overflow in the mp4a packetizer (modules/packetizer/m…
• CVE-2013-4389Multiple format string vulnerabilities in log_subscriber.rb …
• CVE-2013-4390Open redirect vulnerability in the AbstractAuthenticationFor…
• CVE-2013-4392systemd, when updating file permissions, allows local users …5
• CVE-2013-4393journald in systemd, when the origin of native messages is s…
• CVE-2013-4394The SetX11Keyboard function in systemd, when PolicyKit Local…
• CVE-2013-4395Simple Machines Forum (SMF) through 2.0.5 has XSS6.1
• CVE-2013-4396Use-after-free vulnerability in the doImageText function in …
• CVE-2013-4397Multiple integer overflows in the th_read function in lib/bl…