CVE-2002-0391
Critical · 9.8CVSS
9.8
EPSS
58.1%
Published
Aug 12, 2002
CISA due date
—
The record
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | acm | 0 | 5.0-10 |
| Debian:11 | dietlibc | 0 | 0.20-0cvs20020808 |
| Debian:11 | glibc | 0 | 2.2.5-13 |
| Debian:11 | krb5 | 0 | 1.2.5-2 |
| Debian:11 | openafs | 0 | 1.2.6-1 |
| Debian:12 | acm | 0 | 5.0-10 |
| Debian:12 | dietlibc | 0 | 0.20-0cvs20020808 |
| Debian:12 | glibc | 0 | 2.2.5-13 |
| Debian:12 | krb5 | 0 | 1.2.5-2 |
| Debian:12 | openafs | 0 | 1.2.6-1 |
| Debian:13 | acm | 0 | 5.0-10 |
| Debian:13 | dietlibc | 0 | 0.20-0cvs20020808 |
| Debian:13 | glibc | 0 | 2.2.5-13 |
| Debian:13 | krb5 | 0 | 1.2.5-2 |
| Debian:13 | openafs | 0 | 1.2.6-1 |
| Debian:14 | acm | 0 | 5.0-10 |
| Debian:14 | dietlibc | 0 | 0.20-0cvs20020808 |
| Debian:14 | glibc | 0 | 2.2.5-13 |
| Debian:14 | krb5 | 0 | 1.2.5-2 |
| Debian:3.0 | acm | 0 | 5.0-3.woody.1 |
| Debian:3.0 | dietlibc | 0 | 0.12-2.4 |
| Debian:3.0 | glibc | 0 | 2.2.5-11.1 |
| Debian:3.0 | krb5 | 0 | 1.2.4-5woody1 |
| Debian:3.0 | openafs | 0 | 1.2.3final2-6 |
Related vulnerabilities
- CVE-2003-0028 Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR… Also affects dietlibc
- CVE-2015-7547 Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the… Also affects glibc
- CVE-2015-0235 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and… Also affects glibc
- CVE-2014-5119 Off-by-one error in the __gconv_translit_find function in gconv_trans.c in GNU C Library… Also affects glibc
- CVE-2012-4412 Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and… Also affects glibc
- CVE-2013-4788 The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and… Also affects glibc
- CVE-2011-1071 The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow… Also affects glibc
- CVE-2010-4052 Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka… Also affects glibc