Unscored severity · published Nov 23, 2013
CVE-2013-4509
The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password…
–
CVSS
0.3%
EPSS
No
On KEV
Description
The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IB
Ibus · Ibus Project
through 1.5.2; 1.5.4 · source: NVD
OP
Opensuse · Opensuse
13.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4509
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4509
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-11/msg00036.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-12/msg00024.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2014-01/msg00045.html
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1027028
Patch
https://code.google.com/p/mozc/issues/attachmentText?id=199&aid=1990002000&name=ibus-mozc_support_ibus-1.5.4_rev2.diff&token=P62umpXGXx68XJT6zyvBA727wqE%3A1383693105690
Patch
https://github.com/ibus/ibus-anthy/commit/6aae0a9f145f536515e268dd6b25aa740a5edfe7
More from Ibus
7.1
CVE-2019-14822
A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a…