CVE-2003-0967: freeradius

EPSS trend

Probability

4.75%

Chance of exploitation in the next 30 days

Percentile

92%

Versus all other CVEs

30-day change

+0.12 pp

From 4.64% on 19-09-2026

19-09-202619-10-2026

EPSS score

4.75%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

exploit-databasedoslinuxVerified
FreeRadius 0.x/1.1.x - Tag Field Heap Corruption
Maturity: poc

References

15 links

marc.info?l=bugtraq&m=106935911101493&w=2Mailing ListX Refsource BUGTRAQ
marc.info?l=freeradius-users&m=106947389449613&w=2X Refsource CONFIRM
www.redhat.com/support/errata/RHSA-2003-386.htmlVendor AdvisoryX Refsource REDHAT
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10917VDB EntrySignatureX Refsource OVAL
marc.info?l=bugtraq&m=106944220426970Mailing ListX Refsource BUGTRAQ
access.redhat.com/errata/RHSA-2003:386Advisory
access.redhat.com/security/updates/classification/ARTICLE
marc.theaimsgroup.com?l=freeradius-users&m=106947389449613ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=110901REPORT
security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_386.jsonAdvisory

Show all 15 references

access.redhat.com/security/cve/CVE-2003-0967REPORT
bugzilla.redhat.com/show_bug.cgi?id=1617109REPORT
www.cve.org/CVERecord?id=CVE-2003-0967Advisory
nvd.nist.gov/vuln/detail/CVE-2003-0967Advisory
security-tracker.debian.org/tracker/CVE-2003-0967Advisory

Related vulnerabilities

CVE-2007-2028debianfreeradius+62.48%19y ago13-04-2007 18:00Memory leak in freeRADIUS 1.1.5 and earlier allows remote attackers to cause a denial of service (memory consumption) via a large number of EAP-TTLS tunnel connections using malformed Diameter format attributes, which causes the authentication request to be rejected but does not reclaim VALUE_PAIR data structures.CVE-2007-0080debianfreeradius+10.44%19y ago05-01-2007 11:00Buffer overflow in the SMB_Connect_Server function in FreeRadius 1.1.3 and earlier allows attackers to execute arbitrary code related to the server desthost field of an SMB_Handle_Type instance. NOTE: the impact of this issue has been disputed by a reliable third party and the vendor, who states that exploitation is limited "only to local administrators who have write access to the server configuration files." CVE concurs with the dispute CVE-2014-2015debianfreeradius+133.91%11y ago02-11-2014 00:00Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as demonstrated by an SSHA hash.CVE-2001-1376ascendradius+118.54%24y ago11-06-2002 04:00Buffer overflow in digest calculation function of multiple RADIUS implementations allows remote attackers to cause a denial of service and possibly execute arbitrary code via shared secret data.CVE-2001-1377freeradiusfreeradius+105.42%24y ago11-06-2002 04:00Multiple RADIUS implementations do not properly validate the Vendor-Length of the Vendor-Specific attribute, which allows remote attackers to cause a denial of service (crash) via a Vendor-Length that is less than 2.CVE-2005-1454debianfreeradius+11.79%21y ago19-05-2005 04:00SQL injection vulnerability in the radius_xlat function in the SQL module for FreeRADIUS 1.0.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via (1) group_membership_query, (2) simul_count_query, or (3) simul_verify_query configuration entries.

All vulnerabilities infreeradius

CVE-2003-0967: freeradius

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References