Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.
Conclusion & alert: CVE-2013-6424 is rated Moderate Risk (45.8/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 2.88%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 6.84% | 2.88% | -3.96% |
| 2 | 2025-12-14 | 5.57% | 6.84% | +1.27% |
| 3 | 2025-04-16 | — | 5.57% | — |
Full EPSS history (13 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
low | CVE-2013-6424 low priority: Debian including 1 source packages (xorg-server), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2013-6424 |
gentoo
|
normal | CVE-2013-6424: 2 GLSA(s) (201701-64, 201710-30), 1 atom(s) (x11-base/xorg-server); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2013-6424 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2013-6424 |
ubuntu
|
low | CVE-2013-6424 low priority: Ubuntu including 2 source packages (xorg, xorg-server), 16 status rows across 8 suites (lucid, precise, quantal, raring, saucy, trusty, upstream, utopic): not-affected 9, ignored 3, DNE 1, needed 1, needs-triage 1, released 1. | https://ubuntu.com/security/CVE-2013-6424 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| pixman | pixman | < 0.31.2 | cpe:2.3:a:pixman:pixman:*:*:*:*:*:*:*:* |
| debian | debian_linux | 6.0 | cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* |
| debian | debian_linux | 7.0 | cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* |
| opensuse | opensuse | 12.2 | cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* |
| opensuse | opensuse | 12.3 | cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:* |
| opensuse | opensuse | 13.1 | cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* |
| canonical | ubuntu_linux | 12.04 | cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* |
| canonical | ubuntu_linux | 14.04 | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
| canonical | ubuntu_linux | 14.10 | cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| http://lists.opensuse.org/opensuse-updates/2013-12/msg00127.html | Mailing List Third Party Advisory |
| http://lists.x.org/archives/xorg-devel/2013-October/037996.html | Patch |
| http://rhn.redhat.com/errata/RHSA-2013-1868.html | Broken Link |
| http://www.debian.org/security/2013/dsa-2822 | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2013/12/03/8 | Mailing List Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2013/12/04/8 | Mailing List Third Party Advisory |
| http://www.ubuntu.com/usn/USN-2500-1 | Third Party Advisory |
| https://bugs.freedesktop.org/show_bug.cgi?id=67484 | Issue Tracking Patch Vendor Advisory |
| https://bugs.launchpad.net/ubuntu/+source/xorg-server/+bug/1197921 | Issue Tracking Patch Third Party Advisory |
| https://security.gentoo.org/glsa/201701-64 | Third Party Advisory |
| https://security.gentoo.org/glsa/201710-30 | Third Party Advisory |