CVE-2003-0143 The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer....
HighCVSS 10.0
EPSS 8.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| qualcomm qpopper | = 4.0.1 | No fix listed |
| qualcomm qpopper | = 4.0.2 | No fix listed |
| qualcomm qpopper | = 4.0.3 | No fix listed |
| qualcomm qpopper | = 4.0.4 | No fix listed |
References
- 20030310 QPopper 4.0.x buffer overflow vulnerability mailing-list
- 20030312 Re: QPopper 4.0.x buffer overflow vulnerability mailing-list
- 20030314 [OpenPKG-SA-2003.018] OpenPKG Security Advisory (qpopper) mailing-list
- GLSA-200303-12 vendor-advisory
- DSA-259 patch vendor-advisory
- SuSE-SA:2003:018 vendor-advisory
- 7058 exploit patch vdb-entry vendor-advisory
- qpopper-popmsg-macroname-bo(11516) vdb-entry