Unscored severity · published Jan 19, 2014
CVE-2013-2142
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem,…
–
CVSS
0.3%
EPSS
No
On KEV
Description
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Libimobiledevice · Libimobiledevice
1.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-2142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-2142
libiphone.lighthouseapp.com
http://libiphone.lighthouseapp.com/projects/27916-libiphone/tickets/331-insecure-tmp-directory-use
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/06/04/11
www.ubuntu.com
http://www.ubuntu.com/usn/USN-1927-1
Exploit
https://bugs.launchpad.net/ubuntu/%2Bsource/libimobiledevice/%2Bbug/1164263
More from Libimobiledevice
7.3
CVE-2026-116260
libimobiledevice AFC Service afc.c service_receive double free
6.3
CVE-2026-116258
libimobiledevice AFC afc.c heap-based overflow
5.4
CVE-2026-116262
libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow
5.3
CVE-2026-116259
libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption
5.3
CVE-2016-5104
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on…