CVE-2002-0391
Critical · 9.8CVSS
9.8
EPSS
58.1%
Published
Aug 12, 2002
CISA due date
—
The record
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | acm | 0 | 5.0-10 |
| Debian:11 | dietlibc | 0 | 0.20-0cvs20020808 |
| Debian:11 | glibc | 0 | 2.2.5-13 |
| Debian:11 | krb5 | 0 | 1.2.5-2 |
| Debian:11 | openafs | 0 | 1.2.6-1 |
| Debian:12 | acm | 0 | 5.0-10 |
| Debian:12 | dietlibc | 0 | 0.20-0cvs20020808 |
| Debian:12 | glibc | 0 | 2.2.5-13 |
| Debian:12 | krb5 | 0 | 1.2.5-2 |
| Debian:12 | openafs | 0 | 1.2.6-1 |
| Debian:13 | acm | 0 | 5.0-10 |
| Debian:13 | dietlibc | 0 | 0.20-0cvs20020808 |
| Debian:13 | glibc | 0 | 2.2.5-13 |
| Debian:13 | krb5 | 0 | 1.2.5-2 |
| Debian:13 | openafs | 0 | 1.2.6-1 |
| Debian:14 | acm | 0 | 5.0-10 |
| Debian:14 | dietlibc | 0 | 0.20-0cvs20020808 |
| Debian:14 | glibc | 0 | 2.2.5-13 |
| Debian:14 | krb5 | 0 | 1.2.5-2 |
| Debian:3.0 | acm | 0 | 5.0-3.woody.1 |
| Debian:3.0 | dietlibc | 0 | 0.12-2.4 |
| Debian:3.0 | glibc | 0 | 2.2.5-11.1 |
| Debian:3.0 | krb5 | 0 | 1.2.4-5woody1 |
| Debian:3.0 | openafs | 0 | 1.2.3final2-6 |
Related vulnerabilities
- CVE-2003-0028 Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR… Also affects dietlibc
- CVE-2021-3326 The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when… Also affects glibc
- CVE-2009-5155 In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c… Also affects glibc
- CVE-2017-12133 Use-after-free vulnerability in the clntudp_call function in sunrpc/clnt_udp.c in the GNU… Also affects glibc
- CVE-2015-5180 res_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of… Also affects glibc
- CVE-2017-1000366 glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to… Also affects glibc
- CVE-2014-9984 nscd in the GNU C Library (aka glibc or libc6) before version 2.20 does not correctly… Also affects glibc
- CVE-2016-10228 The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when… Also affects glibc