CVE-2013-4394

The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain privileges via vectors involving "special and control characters."

• CWE-276

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357Issue Tracking, Third Party Advisory
• http://www.debian.org/security/2013/dsa-2777Third Party Advisory
• http://www.openwall.com/lists/oss-security/2013/10/01/9Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=862324Issue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201612-34Third Party Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725357Issue Tracking, Third Party Advisory
• http://www.debian.org/security/2013/dsa-2777Third Party Advisory
• http://www.openwall.com/lists/oss-security/2013/10/01/9Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=862324Issue Tracking, Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201612-34Third Party Advisory

Published

Oct 28, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4388Buffer overflow in the mp4a packetizer (modules/packetizer/m…
• CVE-2013-4389Multiple format string vulnerabilities in log_subscriber.rb …
• CVE-2013-4390Open redirect vulnerability in the AbstractAuthenticationFor…
• CVE-2013-4391Integer overflow in the valid_user_field function in journal…
• CVE-2013-4392systemd, when updating file permissions, allows local users …5
• CVE-2013-4393journald in systemd, when the origin of native messages is s…
• CVE-2013-4395Simple Machines Forum (SMF) through 2.0.5 has XSS6.1
• CVE-2013-4396Use-after-free vulnerability in the doImageText function in …
• CVE-2013-4397Multiple integer overflows in the th_read function in lib/bl…
• CVE-2013-4398Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2013-4399The remoteClientFreeFunc function in daemon/remote.c in libv…
• CVE-2013-4400virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local…