CVE-2013-1048

MEDIUM 4.6CVE-2013-1048 · Published 06/03/2013 · updated 16/06/2026

In short

CVE-2013-1048 is a MEDIUM (CVSS 4.6) vulnerability affecting apache2 (debian).
Chance of exploitation in the next 30 days (EPSS): 0.38%, higher than 31.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
apache2 debian	`≤ 2.2.16-6≤ 2.2.22-12`	No fix yet

Description

The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.

References

security.debian.org/debian-security/pool/updates/main/a/apache2/apache2_2.2.16-6+squeeze11.diff.gz · Patch
debian.org/security/2013/dsa-2637 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free