UnratedFix available
ibus-anthy, ibus-chewing and 2 more products — security advisory
The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.
- Products
- ibus-anthy, ibus-chewing, ibus-pinyin, mozc
- Affected versions
- Not specified
- Fixed versions
- 1.12.1599.102-1, 1.4.3-4, 1.5.0-1, 1.5.4-1
- CVEs
- CVE-2013-4509
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 06:32 UTC · Revision 1
Source evidence
The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.
osv:DEBIAN-CVE-2013-4509
ibus-anthy
Fixed versions: 1.5.4-1
ibus-anthy
Fixed versions: 1.5.4-1
ibus-anthy
Fixed versions: 1.5.4-1
ibus-chewing
Fixed versions: 1.4.3-4
ibus-chewing
Fixed versions: 1.4.3-4
ibus-chewing
Fixed versions: 1.4.3-4
ibus-pinyin
Fixed versions: 1.5.0-1
ibus-pinyin
Fixed versions: 1.5.0-1
ibus-pinyin
Fixed versions: 1.5.0-1
mozc
Fixed versions: 1.12.1599.102-1
mozc
Fixed versions: 1.12.1599.102-1
mozc
Fixed versions: 1.12.1599.102-1
Complete source record
{
"id": "38d1a5e14a610a16180c3ac4876ef1198bf9d6169132c66523e22700667df1de",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2013-4509",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2013-4509",
"summary": "The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.",
"evidence": "osv:DEBIAN-CVE-2013-4509",
"products": [
{
"name": {
"value": "ibus-anthy",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.4-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ibus-anthy",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.4-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ibus-anthy",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.4-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ibus-chewing",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.4.3-4",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ibus-chewing",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.4.3-4",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ibus-chewing",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.4.3-4",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ibus-pinyin",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0-1",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ibus-pinyin",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0-1",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "ibus-pinyin",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.5.0-1",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mozc",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.12.1599.102-1",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mozc",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.12.1599.102-1",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mozc",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.12.1599.102-1",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2013-4509",
"aliases": [
"DEBIAN-CVE-2013-4509"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-1"
}
]
}
],
"package": {
"name": "ibus-anthy",
"purl": "pkg:deb/debian/ibus-anthy?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-1"
}
]
}
],
"package": {
"name": "ibus-anthy",
"purl": "pkg:deb/debian/ibus-anthy?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4-1"
}
]
}
],
"package": {
"name": "ibus-anthy",
"purl": "pkg:deb/debian/ibus-anthy?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3-4"
}
]
}
],
"package": {
"name": "ibus-chewing",
"purl": "pkg:deb/debian/ibus-chewing?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3-4"
}
]
}
],
"package": {
"name": "ibus-chewing",
"purl": "pkg:deb/debian/ibus-chewing?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.3-4"
}
]
}
],
"package": {
"name": "ibus-chewing",
"purl": "pkg:deb/debian/ibus-chewing?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-1"
}
]
}
],
"package": {
"name": "ibus-pinyin",
"purl": "pkg:deb/debian/ibus-pinyin?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-1"
}
]
}
],
"package": {
"name": "ibus-pinyin",
"purl": "pkg:deb/debian/ibus-pinyin?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0-1"
}
]
}
],
"package": {
"name": "ibus-pinyin",
"purl": "pkg:deb/debian/ibus-pinyin?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.1599.102-1"
}
]
}
],
"package": {
"name": "mozc",
"purl": "pkg:deb/debian/mozc?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.1599.102-1"
}
]
}
],
"package": {
"name": "mozc",
"purl": "pkg:deb/debian/mozc?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.1599.102-1"
}
]
}
],
"package": {
"name": "mozc",
"purl": "pkg:deb/debian/mozc?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4509.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-12T11:00:04.903389365Z",
"provider": "osv",
"upstream": [
"CVE-2013-4509"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2013-4509"
]
},
"related_cves": [
{
"value": "CVE-2013-4509",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 299735,
"published_at": "2013-11-23T19:55:03.613+00:00"
}