CVE-2003-0143

2004-09-0104:00:00

[email protected]

web.nvd.nist.gov

security

qpopper

buffer overflow

arbitrary code execution

cve-2003-0143

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

7.7 High

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.3%

JSON

The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.

Affected configurations

NVD

Node

qualcommqpopperMatch4.0.1

qualcommqpopperMatch4.0.2

qualcommqpopperMatch4.0.3

qualcommqpopperMatch4.0.4

CPENameOperatorVersion
qualcomm:qpopperqualcomm qpoppereq4.0.1
qualcomm:qpopperqualcomm qpoppereq4.0.2
qualcomm:qpopperqualcomm qpoppereq4.0.3
qualcomm:qpopperqualcomm qpoppereq4.0.4

CPE	Name	Operator	Version
qualcomm:qpopper	qualcomm qpopper	eq	4.0.1
qualcomm:qpopper	qualcomm qpopper	eq	4.0.2
qualcomm:qpopper	qualcomm qpopper	eq	4.0.3
qualcomm:qpopper	qualcomm qpopper	eq	4.0.4