CVE-2002-0391: freebsd Integer Overflow or Wraparound
- 4 references with an unsupported link type were hidden.
Vulnerability summary
CVE-2002-0391 is a high (CVSS 10.0) Integer Overflow or Wraparound vulnerability in freebsd. EPSS estimates a 58.13% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 4 public exploits are recorded.
Timeline
- 02-04-2003PublishedVulnerability first disclosed.
- 16-01-2025Last modifiedVulnerability information updated.
Description
Integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based on SunRPC including dietlibc, allows remote attackers to execute arbitrary code by passing a large number of arguments to xdr_array through RPC services such as rpc.cmsd and dmispd.
CVSS metrics
4 scores · 3 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
58.13%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 58.13% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
4 foundExploit Reference (marc.info)
Maturity: unknown
Exploit Reference (marc.info)
Maturity: unknown
Exploit Reference (marc.info)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian5 products
- acm< 5.0-10 | < 5.0-3.woody.1
- dietlibc< 0.20-0cvs20020808 | < 0.12-2.4
- glibc< 2.2.5-13 | < 2.2.5-11.1
- krb5< 1.2.5-2 | < 1.2.4-5woody1
- openafs< 1.2.6-1 | < 1.2.3final2-6
Microsoft3 products
Freebsd1 product
- freebsd≤ 4.6.1
Openbsd1 product
- openbsdEOL3.1
5 vendors · 12 products
References
35 links- www.cert.org/advisories/CA-2002-25.htmlThird Party AdvisoryX Refsource CERTPatchUS Government Resource
- online.securityfocus.com/advisories/4402Vendor AdvisoryX Refsource HPBroken LinkThird Party AdvisoryVDB Entry
- bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823Third Party AdvisoryX Refsource ISSBroken LinkVendor Advisory
- distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000515Vendor AdvisoryX Refsource CONECTIVABroken Link
Show all 35 references
- distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000535Vendor AdvisoryX Refsource CONECTIVABroken Link
docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-057Vendor AdvisoryX Refsource MSThird Party Advisory- online.securityfocus.com/archive/1/285740Mailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4728VDB EntrySignatureX Refsource OVALBroken Link
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A42VDB EntrySignatureX Refsource OVALBroken Link
- www.linuxsecurity.com/advisories/other_advisory-2399.htmlVendor AdvisoryX Refsource ENGARDEBroken Link
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9VDB EntrySignatureX Refsource OVALBroken Link
- www.mandrakesoft.com/security/advisories?name=MDKSA-2002:057Vendor AdvisoryX Refsource MANDRAKEBroken Link