CVE-2013-0160

Name	CVE-2013-0160
Description	The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device.
Source	CVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
References	DSA-2669-1
NVD severity	low (attack range: local)
Debian/oldstable	package linux-2.6 is vulnerable; however, the security impact is unimportant.
Debian/stable	not vulnerable.
Debian/testing	not vulnerable.
Debian/unstable	not vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	wheezy	3.2.65-1	fixed
	wheezy (security)	3.2.65-1+deb7u2	fixed
	jessie, sid	3.16.7-ckt4-3	fixed
linux-2.6 (PTS)	squeeze (security), squeeze	2.6.32-48squeeze6	vulnerable
	squeeze (lts)	2.6.32-48squeeze11	vulnerable

The information above is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
linux	source	(unstable)	3.8.12-1	unimportant
linux	source	wheezy	3.2.41-2+deb7u2	low	DSA-2669-1
linux-2.6	source	(unstable)	(unfixed)	unimportant

Minor information leak, rather a missing hardening feature than a security vulnerability.